Detections
Analytics

NET0340 - Network devices must display the DoD-approved logon banner warning - 'banner motd'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.

 DoD CIO has issued new, mandatory policy standardizing the wording of 'notice and consent' banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, 'Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement', dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.

Solution

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:

 Option A

 You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

 By using this IS (which includes any device attached to this IS), you consent to the following conditions:

 -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

 -At any time, the USG may inspect and seize data stored on this IS.

 -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

 -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

 -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

 Option B

 If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: 'I've read & consent to terms in IS user agreem't.'

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_L2_Switch_V8R27_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-8, CAT|II, Rule-ID|SV-3013r5_rule, STIG-ID|NET0340, Vuln-ID|V-3013

Plugin: Cisco

Control ID: cea3f77708e34a85e07f113c793ae5771eff1889323bed83411a7656c59e7012