ARBA-NT-000100 - AOS must use Transport Layer Security (TLS) 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.

800-53|AC-17(2)

CAT|II

CCI|CCI-000068

CCI|CCI-001453

Rule-ID|SV-266557r1040161_rule

STIG-ID|ARBA-NT-000100

Vuln-ID|V-266557

ARBA-NT-000120 - AOS must protect wireless access to the network using authentication of users and/or devices.

800-53|AC-18(1)

CCI|CCI-001443

CCI|CCI-001444

Rule-ID|SV-266559r1040167_rule

STIG-ID|ARBA-NT-000120

Vuln-ID|V-266559

ARBA-NT-000130 - The network element must protect wireless access to the system using Federal Information Processing Standard (FIPS)-validated Advanced Encryption Standard (AES) block cipher algorithms with an approved confidentiality mode.

800-53|IA-3(1)

CCI|CCI-001967

Rule-ID|SV-266560r1040170_rule

STIG-ID|ARBA-NT-000130

Vuln-ID|V-266560

ARBA-NT-000300 - AOS must be configured to disable nonessential capabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-266577r1040221_rule

STIG-ID|ARBA-NT-000300

Vuln-ID|V-266577

ARBA-NT-000440 - AOS must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-266591r1040263_rule

STIG-ID|ARBA-NT-000440

Vuln-ID|V-266591

ARBA-NT-000800 - AOS must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.

800-53|IA-11

CCI|CCI-002039

Rule-ID|SV-266627r1173879_rule

STIG-ID|ARBA-NT-000800

Vuln-ID|V-266627

ARBA-NT-000850 - The network element must authenticate all network-connected endpoint devices before establishing any connection.

800-53|IA-3

CCI|CCI-001958

Rule-ID|SV-266632r1040624_rule

STIG-ID|ARBA-NT-000850

Vuln-ID|V-266632

ARBA-NT-000920 - AOS must use cryptographic algorithms approved by the National Security Agency (NSA) to protect national security systems (NSS) when transporting classified traffic across an unclassified network.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-266639r1117244_rule

STIG-ID|ARBA-NT-000920

Vuln-ID|V-266639

ARBA-NT-000970 - AOS, in conjunction with a remote device, must prevent the device from simultaneously establishing nonremote connections with the system and communicating via some other connection to resources in external networks.

800-53|SC-7(7)

CCI|CCI-002397

Rule-ID|SV-266644r1040422_rule

STIG-ID|ARBA-NT-000970

Vuln-ID|V-266644

ARBA-NT-001590 - When AOS is used as a wireless local area network (WLAN) controller, WLAN Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) implementation must use certificate-based public key infrastructure (PKI) authentication to connect to DOD networks.

Rule-ID|SV-266703r1040640_rule

STIG-ID|ARBA-NT-001590

Vuln-ID|V-266703

ARBA-NT-001600 - The site must conduct continuous wireless Intrusion Detection System (IDS) scanning.

800-53|SI-4(23)

CCI|CCI-002686

Rule-ID|SV-266704r1192887_rule

STIG-ID|ARBA-NT-001600

Vuln-ID|V-266704

ARBA-NT-001610 - AOS, when configured as a WLAN bridge, must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-266705r1040645_rule

STIG-ID|ARBA-NT-001610

Vuln-ID|V-266705

ARBA-NT-001650 - AOS, when used as a WLAN bridge or controller, must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-266707r1040611_rule

STIG-ID|ARBA-NT-001650

Vuln-ID|V-266707

ARBA-NT-001660 - AOS wireless local area network (WLAN) service set identifiers (SSIDs) must be changed from the manufacturer's default to a pseudo random word that does not identify the unit, base, organization, etc.

Detections

Analytics

DISA HPE Aruba Networking AOS Wireless STIG v1r2

Audit Details

File Details

Audit Changelog

No revisions found