3.1 NSTISSAM TEMPEST - Red Black Installation Guidance.pdf

NS

NATIONAL

SECURITY

TELECOMMUNICATIONS

AND

INFORMATION

SYS'IEKS

SECURITY

NSTISSAM TEMPEST /2-95

12 December 1995

RED IBLACK INSTALLATION

GUIDANCE

FOR OFFICIAL USE ONLY

NSTISS

NATIONAL MANAGER

NATIONAL SECURITY

TELECOMMUNICATIONS

AND INFORMATION -

SYSTEMS SECURITY

FOREWORD

1. National Security Telecommunications and Information Systems Security Advisoty Memorandum (NSTISSAM)TEMPEST/2-95, RED/BLACK Installation Guidance specifies RED/BLACK equipment/system installation guidance, provides an explanation of the TEMPEST policy concept. and addresses RED IBLACK considerations for facilities wherein national security information is processed. This publication supersedes National COMSEC Information Memorandum (NACSIM)5203. dated 30 June 1982. However. Appendix K of NACSIM 5203 will remain in effect until NACSI 4009. Protected Distribution Systems. dated 30 December 1981. is superseded. NACSI 4009 is currently under revision.

2. TEMPEST security is a function of the TEMPEST characteristics of the processing equipment. the way the equipment is installed, the electromagnetic and physical characteristics of the facility. and the geographical environment where the facility is located.

3. The guidance identified herein will be considered by a Certified TEMPEST Technical Authority (CITA) as part of the potential solution for facilities. system, and equipment that have been identified as requiring TEMPEST countermeasures.

Only those specific criteria identified by the CTfA will be implemented.

4. Representatives of the National Security Telecommunications and Information Systems Security Committee may obtain additional copies of this instruction from:

Executive Secretariat National Security Telecommunications and

Information Systems Security Committee National Security Agency Fort George G. Meade. MD 20755-6000

5. U.S. Government contractors are to contact their appropriate government agency or Contracting Officer Representative regarding distribution of this document.

Is!J. M. McCONNELL Vice Admiral, U.S. Navy

--- - - - I

NSTISSAM TEMPEST 2/95A

3 February 2000

AMENDMENT TO ADVISORY l\tIEMORANDUM

TEMPEST 2/95

REDIBLACK INSTALLATION GUIDANCE

THIS DOCUMENT PROVIDES MINIMUM STANDARDS. FURTHER

IMPLEMENTATION MAY BE REQUIRED BY YOUR DEPARMENT OR AGENCY

National Security Telecommunications and Information Systems Security Committee

NATIONAL MANAGER

FOREWORD

1. NSTISSAM TEMPEST 2/95, RED/BlACK Installation Guidance has been amended to clarify the recommendations for installation which are presented in Recommendations A through I. Please replace pages 17, IS, 19, 20,21,22,27, 2S, 41, and 42 in your current document with the enclosed and destroy the replaced pages. These minor changes have been approved by the TEMPEST Advisory Group.

2. Representatives of the National Security Telecommunications and Information Systems Security Committee (NSTISSC) may obtain additional copies of this instruction from the Secretariat at the address listed below.

MtiAF-L V. HAYDEN Lieutenant General, USAF

NSTISSC Secretariat (V503) ·National Security Agency ·9800 Savage Road STE 6716 ·Ft Meade MD 20755-6716

(410) 854-6805 ·UFAX: (410) 854-6814

nstissc@radium.ncsc.mil

TABLE OF CONTENTS

SECTION 1 - INTRODUCTION

1.1.

1.2.

1.3.

1.4. Revision

1.5.

1.6.

1.7.

1.8.

General

Scope Content

1.8. l.

1.8.2.

1.8.3.

Policy

Application Comments and Recommendations

References Government Documents and Publications

Government Documents

Non-Government Publications

SECTION 2 - DEFINmONS 5

SECTION 3 - RED/BLACK INSTALLATION RECOMMENDATIONS

3.1. General

3.2.

3.3. Use of Table 3-1 . . .

3.4. TEMPEST Guidance

RECOMMENDATIONA

RECOMMENDATIONB

RECOMMENDATION C

RECOMMENDATIOND

RECOMMENDATIONE

RECOMMENDATIONF

RECOMMENDATIONG

RECOMMENDATIONH

RECOMMENDATION I .

Installation Recommendations

SECTION4 - GUIDANCE FOR TEMPEST INTEGRI1Y

4.1.

4.2.

General TEMPEST Basics

4.2.1. Generation of CE

4.2.2. CE Sources

4.2.2.1. Functional Sources

4.2.2.2. Incidental Sources

RED/BLACKBasics

294.3.

4.3.1. Facility Considerations. . . . . . . . . . . . . . . . . . . . . .,

4.3.2. Physical Security Considerations 30

4.4. Signal Cables

4.4.1. Shielded Metallic Cables

4.4.1.1. Cable Characteristics 30

4.4.1.2. Shield Tennination

4.4.2. Optical Fiber Cables

4.4.2.1. Applications of Optical Fiber Cable Systems 31

4.4.2.2. Multifiber Cables 31

4.4.2.3. Cable Strength Members or Shielding

4.5. Signal Distribution 31

4.5.1. Wireways

4.5.2. Patching Equipment

4.5.3. Distribution Equipment (Wire Closets) 32

4.5.4. Protected Distribution Systems

4.6. Signal Line Isolators and Filters

4.6.1. Signal Line Isolation

4.6.2. Assessing the Need for Signal Isolation

4.6.3. Passive Signal Line Filters 33

4.6.3.1. Lowpass Filters

4.6.3.1.1. Analog Signal Line Filters 33

4.6.3.1.2. Inductive-Capacitive (LC)Signal Line Filters 33

4.6.3.1.3. Digital Signal Line Filters 34

4.6.4. Active Signal Line Filters 34

4.6.4.1. Linear Filters 34

4.6.4.2. Saturated Amplifiers

4.6.5. Isolators 35

4.6.5.1. Magnetic-coupled Isolators

4.6.5.2. Acoustic-coupled Isolators 35

4.6.5.3. Photon-coupled Isolators 35

4.6.5.3.1. Signal Line Isolators 36

4.6.5.3.2. Advantages of Photon-coupled Isolators

4.7. Power Distribution

4.7.1. The Power Requirement

4.7.2. Power Conditioning/Isolation

4.7.2.1. PowerlineFilters

4.7.2.2. Isolation Transfonners 38

4.7.2.3. Uninterruptible Power Supplies and Power Regulators 38

4.7.2.3.1. Solid-state UPS (SSUPS)

4.7.2.3.2. RotatingUPS

4.8. GroundingSystem

FOR OFFICIALUSE ONLY

4.8.1. Equipotential Plane 38

4.8.2. Single Point Ground

4.8.3. Fault Protection Ground

4.8.4. IsolatedGround

4.9. Administrative Support Equipment 39

4.9.1. TelephoneSystems

4.9.1.1. TEMPESTProtective Measures 40

4.9.1.2. On-hookSecurity

4.9.2. Paging, Intercom, and Public Address Systems. . . . . . . . . . . . . . . . . . . . : . 40

4.9.3. AlarmSystems

4.9.4. MiscellaneousFortuitousConductors

4.9.5. RadioTransmissionor ReceptionDevices

4.9.6. Commercial TelevisionSystem Installation

4.10. Other Considerations

4.10.1 TEMPEST Zoning 42

4.10.2. Inspectable Space 42

4.10.3. Facility Shielding

4.10.4. TEMPEST Suppressed Equipment 42

SECTION 5 - SECURE VOICE SYSTEMS 43

5.1. General

5.2. Basis for Minimum Installation Techniques 43

5.3. Installation Guidance 43

5.3.1. General 43

5.3.2. Multiple Terminal Installations

5.3.3. Location

5.3.4. High-risk Areas 43

5.4. Security Guidance

5.4.1. Terminals with Multiple Handsets 43

5.4.2. Location of Equipment

5.4.3. High-risk Areas 44

5.5. STU-IIIGuidance

SECTION 6 -SENSITIVE COMPARTMENTED INFORMATION 45

6.1. General

6.2. Routing of SCI Cables 45

6.3. TerminationBoxes

6.4. Distribution Frame 45

6.5. Patch Panels 45

6.6. Multiplexers, Video and Audio Switches, and Other Multiple Circuit Equipment . . 46 iii

6.7. AccessPoints

6.8. Cables 46

6.9. Low-levelSignaling 46

6.10. Powerand SignalLineFiltering

6.11. Standard Service Features

6.12. TelephoneLines

6.13. RED/BLACKSeparation 47

6.14. Additional Requirements 47

SECTION 7 - TRANSPORfABLE SYS1EMS IN A TACTICALENVIRONMENT

7.1. General

7.2. Modes of Operation 49

7.2.1. FixedOperation

7.2.1.1. RED Cables 49

7.2.1.2. Separation

7.2.1.3. CTTAReview 49

7.2.2. FieldDeployed

7.2.3. VehicularMounted

7.3. DeployingEquipment Awayfrom Transportables 50

7.4. PhysicalSecurity

SECTION 8 -AIRCRAFT

8.1. General 51

8.2. Aircraft Installations

8.2.1 . Airborne Operations

8.2.1.1. RED Cables

8.2.1.2. Separation 51

8.2.1.3. Grounding 51

8.2.2. Ramp Operations . .. 51

8.2.3. Physical Security

SECTION 9 - SHIPS 53

9.1. General

9.2. Shipboard Installations 53.

9.2.1. UnderwayOperations

9.2.1.1. RED Cables 53

9.2.1.2. Separation

9.2.1.3. Shielded Cables 53

9.2.1.4. RED Ground 53

9.2.1.5. Cryptographic Equipment Ground 53

9.2.1.6. Cable Distribution 53

IV

9.2.2. In Port Operations 53

9.2.3. PhysicalSecurity

Comment Fonn for NSTISSAM TEMPEST2/95 55 v

TffiS PAGE IS INTENTIONALLY LEFT BLANK

VI

SECTION 1

INTRODUCTION

1.1. General. This section contains introductory and administrative information associated with this document.

1.2. Scope. This document defines the guidance to consider during the design of facilities and for subsequent installation of equipment and systems that receive, transmit, manipulate, graph, store, archive, calculate, generate, print, or in any other manner process national security information. This guidance is part of the potential solution for facilities, systems and equipment identified as requiring TEMPEST countermeasures.

1.3. Content. The text includes a brief oveIViewof the TEMPEST national policy and provides RED/BIACK installation guidance that may be identified by the Certified TEMPEST Technical Authority (CTIA) as part of the solution for systems and facilities that require the application of TEMPEST countermeasures.

1.4. Revision. This document correlates to the previous issue (NACSIM5203) in concept only.

The content has been extensively changed and reorganized to reflect current policy considerations and emerging technology.

1.5. Policy. The NationaIPoUcy on the Control of Compromising Emanations (NSTISSP 300) and its implementing instructions, TEMPEST CoWltenneasures for Facilities (NSTISSI 7000), and NONSTOP Countenneasures (NSTISSI 7001) establish the policy that certain systems and facilities that process national security information (NSI)must be reviewed by a CTIA. If such a review is required and the review determines that TEMPEST countermeasures are required, the CTIA will consider a variety of methods that can be applied to the system/facility to achieve TEMPEST security. The RED/BIACK guidance contained in this document will be considered by the CTIA along with other measures (e.g., TEMPEST Zoning, TEMPEST suppressed equipment and shielding) to determine the most cost-effective countermeasures to achieve TEMPEST security. Only those RED/BIACK criteria specifically identified by the CITA will be implemented.

1.6. Application. The guidance contained herein, when specified by a CTIA, is applicable to U.S. Government departments, agencies and contractors.

1.7. Comments and Recommendations. Revisions to this publication will be made as appropriate. Comments and recommendations are encouraged. Government organizations should submit their comments to their appropriate government or agency authority.

Department and agency authorities may submit their comments to:

Attn: C3 Department of Defense National Security Agency Fort George G. Meade, Maryland 20755-6000

Contractors should submit their comments regarding this publication to their contracting government organization. Industrial firms that have no government TEMPEST-related contact may address their comments to the above address. A comment form is provided at the end of this document for this purpose. When submitting comments, this form may be reproduced or a similar format may be used.

1.8. References. The following references contain infonnation that supplement the infonnation contained herein. The effective editions of these references should be reviewed by persons involved in performing engineering and installation of equipment and systems that process national security information.

1.8.1. Government Documents and Publications. The following government documents and publications form a part of this document to the extent specified herein. Unless otherwise specified. the issues of these documents are those currently listed in the applicable publication index.

AIR FORCE (AF)

TPDL (C)TEMPEST Profile Data List

DCID 1/21

DIRECTOR CENTRAL INTElliGENCE DIRECTIVE (DCID)

(U] Implementation Manualfor Physical Secwity St.and.aTdsfor Sensitive Compartmented Information Facilities

FEDERAL COMMUNICATIONS COMMISSION (FCC)

FCC Reg Part 15 Subpart J (U]Rules and Regulations. Radio Frequency Devices: Computing Devices

JOINT CHIEFS OF STAFF

JCS Pub 1 (U]Dictionary of Military and Associated Tenns

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

FIPS PUB 94 (U]Guideline on Electrical Power and ADP Installations

NATIONAL SECURITY AGENCY (NSA)

ISSO (U]INFOSEC Products and Services Ca1alogue Contents:

- Endorsed CRYPTOProducts List

- NSA-Endorsed DES Products List

- Protected Network Services List

- Eval Trusted Computer Systems List

- Preferred Products List

- Endorsed Products List

- .NSA Degausser Products List

(The above publication is obtained by ordering from the Government Printing Office (GPO) as a single copy or as a yearly subscription. Price is subject to change - it will be given at time of order. Requests for copies or subscription should be addressed to: Superintendent of Documents. U.S. Printing Office. Washington. DC 20402).

National TEMPEST Infonnation Center

(U] 1EMPEST Zone Assignments for Infonnation-Processing Equipment

NATIONAL SECURITY TELECOMMUNICATIONS AND INFORMATION SYSTEMS SECURITY

COMMITTEE (NSTISSC)

NACSI 4009 (C)Protected Distribution Systems

NACSIM 5000 (C) TEMPEST Fundamentals

NSTISSAM TEMPEST/1-92 (C) Compromising Emanations Laboratory Test Requirements, Electromagnetics

NSTISSAM TEMPEST /2-92 (FOUO) Proced1Jres for TEMPEST Zoning

NSTISSAM TEMPEST/1-93 (C) Compromising Emanations Field Test Requirements, Electromagnetics (U)

NSTISSAM TEMPEST /1-95 (V) Shielded Enclosures

NSTISSI No. 7000 (C) TEMPEST Countermeasures for Facilities

NSTISSI No. 700 1 (S) NONSTOP Countenneasures

NSTISSI No.7002 (S) TEMPEST Glossary

NSTISSP No.300 (C) National poUcy on Compromising Emanations

1.8.2. Government Documents. The following government documents fonn a part of this document to the extent specified herein. Unless otheIWise specified, the issues of these documents are those that are currently listed in the applicable publication index.

HANDBOOKS

MIL-HDBK-411 (V) Power and Environmental Controlfor the Physical Plant of DoD Long-Haul Communications

MIL-HDBK-419A (V) Grounding, Bonding, and Shielding for Electronic Equipment and Facilities

SPECIFICATIONS

MIL-C-17 (V) Cable, Radio Frequency, Flexible and Semirigid, General Spedfrcations For.

MIL-C-915 (V) Cable and Cord, ElectricaL For Shipboard Use, General Spedfrcations For.

MIL-C-23437 (V) Military Spedfications for Cable, ElectricaL Shielded PaiTs

MIL-C-24640 (V) Cable, ElectricaL Lightweightfor Shipboard Use, General Sped.fications For.

MIL-C-24643 (V) Cable and Cord, ElectricaL Low Smoke, For Shipboard Use, General Specifications For. .

MIL-F-15733 (V) Military Spedfications for Filters, Radio Frequency Interference

STANDARDS

FED-STD-1037 (U)Glossary ofTelecomnumication Terms

MIL-STD-188-100 (U)Common Long-Haul and Tactical Communications Systems Technical Standards

MIL-STD-188-111 U)Subsystem Design and Engineering Standards for Common Long-Haul and Tactical Fiber Optic Communications

MIL-STD-188-1l4 (U) Electrical Characteristics of Digi1al Interface Circuits

MIL-STD-188-124 (U)Grounding, Bonding, and Shielding for Common Long-Haul/Tactical Comnumication Systems, including Ground Based Communication Electronics Facilities and Equipment

MIL-STD-220 (U)RF1Filters, Methods of Testing

(C)Shipboard Bonding, Grounding, and Other Techniques for Electromagnetic Compatibility and Safety.

MIL-STD-1310

(Unless otherwise indicated. copies of Federal and Military specifications. standards. and handbooks are available from the Naval Publications and Fonns Center. Attn: NPODS, 5801 Tabor Avenue. Philadelphia, Pa 19120-5099.)

TELEPHONE SECURITY GROUP

TSG 1 (U) Introduction to Telepfwne Security

TSG2 (U)TSG Guidelines for Computerized Telepfwne Systems

TSG6 (U) TSG Approved Equipment

1.8.3. Non-Government Publications. The following document fonns a part of this document to the extent specified herei,n. Unless otheIWise specified. the issue of this document is that currently listed in the applicable publication index.

TELECOMMUNICATIONS INDUSTRIES ASSOCIATION (TIA)

EIA-RS-232 (U)Interface between Data Terminal Equipment and Data CircuiHenninating Equipment employing Serial Binary Data Interchange

(Application for copies should be addressed to the Telecommunications Industries Association (TIA),Attn: Standard Sales Office. 2001 I Street NW. Washington. DC 20006)

NATIONALFIRE PROTECTION ASSOCIATION, INC. (NFPA)

NFPA No. 70-1994 (U) National Electrical Code@ SECIION 250

SECTION 2

DEFINITIONS

The terms in this document are defined in FED-STD-I037, JCS Pub I, NACSI 4009, and NSTISSI 7002. For the purposes of this document, definitions are provided for the following terms, some that have been repeated from the foregoing publications for the convenience of the reader.

BLACKEquipment. A term applied to equipment that processes only unclassified and/ or encrypted in~ormation.

BLACKOptical Fiber Line. An optical fiber that carries a BLACKsignal or that originates/terminates in a BLACKequipment or system.

BLACKLine. An optical fiber or a metallic wire that carries a BLACK signal or that originates/terminates in a BLACKequipment or system.

BLACKWire Line. A metallic wire that carries a BLACKsignal or that originates/terminates in a BLACKequipment or system.

Bulk Filtering. The practice of using filters either at the first service disconnect or on each power panel and thereby filtering power to many items of equipment with one set of filters.

Certified TEMPEST Technical Authority (CTTA). An experienced, technically qualified U.S.

Government employee who has met established certification requirements in accordance with NSTISSC-approved criteria and has been appointed by a U.S. Government department or agency to fulfill CTIA responsibilities.

Collateral. All national security information classified under the provisions of an executive order, for which special community systems of compartmentation [e.g., non-Special Compartmented Information (non-SCI), General Service Classified Information (GENSER)) are not formally established.

Commercial-off-the-Shelf (COTS). Commercially manufactured equipment that have no TEMPEST countermeasures intentionally built into them.

Common Wall Facility. A facility that shares a building, wall, floor or ceiling with uninspectable areas. .

Compromising Emanations (CE). Unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or automated information systems equipment.

Equipment TEMPEST Zone (ETZ). A required secure distance (Zone) assigned an equipment based on the TEMPEST Electric field radiation characteristics of an equipment compared to the limits of NSTISSAMTEMPEST /1-92 (Zone A :;;Level I; Zone B :;;Level II; Zone C :;;Level III; Zone D > Level III).

FacilityTEMPESTZone (FTZ). A space assignment based on the measured ability of the facility structure to meet the limits of NSTISSAMTEMPEST/2-92.

Hardened Cable Path. A material. container or facility that provides physical protection for the cable and causes a delay to a perpetrator attempting unauthorized penetration or intrusion le.g.. a Protected Distribution System (PDS)).

Inspectable Space (IS). The three dimensional space surrounding equipment that processes classified and/ or sensitive information within which TEMPEST exploitation is not considered practical or legal authority to identify and/ or remove a potential exploitation exists.

National Security Infonnation (NSI). Information that has been determined. pursuant to Executive Order 12958 or any predecessor order. to require protection against unauthorized disclosure, and that is so designated.

RED/BLACKConcept. Separation of electrical and electronic circuits. components. equipment.

and systems that handle national security information (RED). in electrical form. from those that handle non-national security information (BLACK)in the same fonn. (Under this concept.

RED and BLACKterminology is used to clarify specific criteria relating to. and to differentiate between, such items as circuits, components. equipment, systems etc., and also the areas where they are contained.)

RED Equipment. A term applied to equipment that processes unencrypted NSI that requires protection during electrical/ electronic processing.

RED Optical Fiber Line. An optical fiber that carries a RED signal or that originates/terminates in a RED equipment or system.

RED Line. An optical fiber or a metallic wire that carries a RED signal or that originates/terminates in a RED equipment or system.

RED Wire Line. A metallic wire that carries a RED signal or that originates/terminates in a RED equipment or system.

TEMPEST Certified Equipment or System. Equipment or systems that have complied With the national requirements of NSTISSAM TEMPEST/1-92 Level I or previous editions.

Uncontrolled Access Area (UAA). The space in and around a building where no personnel access controls are exercised.

SECTION 3

RED/BLACK INSTAllATION RECOMMENDATIONS

3.1. General.There are many variables within a facility that can affect the opportunity for the collection of compromising emanations. Chief among these are the radiation characteristics of the infonnation processing equipment. placement of signal and power cables. presence of fortuitous conductors. radio frequency (RF) attenuation of building materials. and the amount of inspectable space surrounding the facility.

3.2. InstallationRecommendations.Table 3-1 summarizes the general RED/BLACKinstallation recommendations to meet NSTISSP No. 300. NSTISSI No. 7000 and NSTISSI NO. 7001 policy criteria. The matrix of the table for equipment and facilities with TEMPEST zone ratings was derived using guidance in NSTISSAM TEMPEST/2-92. Procedures for 1EMPEST Zoning. The cognizant CTTAmust be consulted in the initial p1S11nningphases for facilities that wiD process classified information. This is especially important for large projects where the architectural and engineering design and documentation phase is a major cost item. The CITA has the responsibility for conducting or validating TEMPEST reviews and recommending TEMPEST countenneasures. including RED/BLACK installation measures. There should be no commitment of funds without CITA concurrence. Failure to consult the CITA could result in installation of unnecessary and/or expensive countenneasures or the omission of needed countenneasures.

3.3. Use of Table 3-1. The installation recommendations in Table 3-1 are for RED equipment (boxes along the left side) installed in one of three facility TEMPEST zones (boxes along the top side). The recommendations in the matrix are identified in the pages following the table.

. Facilities are listed by TEMPEST zone rating and surrounding inspectable space (IS). Facility zone ratings are the preferred method to detennine facility TEMPEST characteristics since they are derived from the measured RF attenuation provided by the facility structure. the effects of fortuitous conductors. and the surrounding inspectable space. The inspectable space distances should be used only if the facility has not been TEMPEST zoned.

. Equipment TEMPEST zone ratings should be used if available. Zone D has been combined with Zone C for the purpose of defming the recommendations in this section. .If an equipment has not been TEMPEST zoned and no TEMPEST profile data is available. the "All Other RED Equipment" category should be used.

. When installing a system that contains equipment with multiple zone ratings.

the system should be installed in compliance with the most stringent equipment zone recommendations. For example. if a system containing equipment rated Zone A, Zone B and Zone C is to be installed in a Facility Zone C space. the entire system should be installed to meet equipment Zone C recommendations.

The resulting recommendations are identified in the matrix box at the intercept that is three boxes to the right of the Equipment Zone C box and three boxes down from the Facility Zone C box. This identifies Recommendation I.

FOR OFFICIALUSEONLY

. Recommendation distances are stated in Metric units. The approximate English equivalents are:

3.4. TEMPESTGuidance. Section 4 contains TEMPEST-related guidance that will assist in the implementation of the recommendations contained in Table 3-1.

FOR OFFICIAL USE ONLY

Metric English

2.5cm lin

5cm 2in

15 cm 6 in

30cm 12 in

50cm 20 in

1m 39 in

2m 79 in

3m 10ft

8m 26 ft

20m 66 ft

30m 98 ft

100m 328 ft

EQUIPMENT

meets

NSTISSAM 1/92

Levell

(Zone A)

EQUIPMENT

meets

NSTISSAM 1/92

Level II

(Zone B)

EQUIPMENT

meets

NSTISSAM 1/92

Level III and all other

RED equipment (Zone C)

FACILITY

ZONE A

Or inspectable space less than 20 m

(Note 1)

Recommendation A

Recommendation B

(Note 2)

Recommendation C

(Note 2)

FACILITY

ZONE B

FACILITY

ZONE C

Or inspectable space greater than 20 m but less than 100 m

Or inspectable space Greater than 100 m

Recommendation D

Recommendation G

Recommendation E

Recommendation H

Recommendation F

(Note 2)

Recommendation I

NOTE 1: Additional precautions may be necessary if inspectable space is less than 8 meters or common wall situations exist

NOTE 2: This installation may create TEMPEST hazards.

IMPORT ANT!

The CTTAhas responsibility for conducting or validating TEMPEST reviews and recommending TEMPEST countermeasures, including RED/BLACKinstallation measures. There should be no commitment of funds without CTTA concurrence. Failure to consult the CTTA could result in installation of unnecessary and/or expensive countermeasures or the omission of needed countermeasures. .

Table 3-1. RED/BLACK Installation Recommendations

THIS PAGE IS INTENTIONALLY LEFT BLANK

RECOMMENDATION A

Installing NSTISSAM TEMPEST/1-92 (Level 1) or Zone A RED Equipment in a TEMPEST Zone A Facility

(If not TEMPEST zoned, inspectable space less than 20 meters.)

Note: Additional precautions may be necessary if the inspectable space is less than 8 meters.

Contactyour CITAfor specifICguidance.

1. A separation of 50 centimeters should be maintained between any RED processor and:

a. BLACKequipment (including administrative support equipment).

b. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

c. BLACK power lines.

d. Fortuitous conductors that exit the inspectable space.

Note: if the separation cannot be maintained, the CITA must conduct a review to determine whether filters or other countermeasures should be recommended.. For existing facilities. the CITA may request TEMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED line and:

a. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACKpower lines.

Notes:

1. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BlACK wire lines should not use a common distribution vehicle.

3. RED and BlACK opticalfiber lines may use a common distribution vehicle providing that: RED and BlACK opticalfiber lines are not mixed within a rnultffiber cable: when a BlACK opticalfiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering eachjiber and there should be no metallic stiffeners or metallic sheath in the BlACK optical fiber cable. When a RED opticaljiber cable is used in a BlACK distribution vehicle. in addition to the above, the RED opticaljiber cable must be separatedfrom the BlACK distribution vehicle at the point where the BlACK distribution vehicle exits the inspectable space. if the RED optical.fiber cable exits the inspectable space, it must be prbvided appropriate protection (encryption. protected distribution systems [PDS}).

3. Shielded Cables.

a. RED processors meeting the requirements of NSTISSAMTEMPEST/1-92 (Levels I. II, or III)must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

b. RED wire cables should be shielded and insulated overall.

. u . ... ... .. u

REClJMMENDATION B

Installing NSTISSAM TEMPEST/1.92 (Levell!) or Zone B RED Equipment in a TEMPEST Zone A Facility

(If not TEMPEST zoned, inspectable space less than 20 meters.)

Note: Additional precautions may be necessary if the inspectable space is less than 8 meters.

Contact your ClTAfor sPecifu: guidance.

Note: These installations may create TEMPEST hazards. Contact your ClTAfor speclfu:

guidance.

1. A separation of one meter should be maintained between any RED processor and:

a. BLACKequipment (including administrative support equipment).

b. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

c. BLACKpower lines.

d. Fortuitous conductors that exit the inspectable space.

Note: if the separation cannot be maintained., the CITA must conduct a review to detennine whether filters or other countenneasures should be recommended. For existing facilities. the CITA may request TEMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED line and:

a. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACKpower lines.

Notes:

1. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK opticalfiber lines may use a common distribution vehicle providing that: RED and BLACK opticalflber lines are not mixed wilhin a multifiber cable: when a BLACK optical fiber cable is used in a RED distribution vehicle. there should be an opaque dielectric sheath covering eachfiber and there should be no metallic stiffeners or metallic sheath in the BLACK opticalfiber cable. When a RED optical.fiber cable is used in a BLACK distribution vehicle. in additWn to the above. the RED opticalfwer cable must be separatedfrom the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectable space. if the RED optical.fiber cable exits the inspectable space. it must be provided appropriate protection (encryption, protected distribution systems /PDS]J.

3. Shielded Cables.

a. RED processors meeting the requirements of NSTISSAMTEMPEST/1-92 (Levels I, II, or III)must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

b. RED wire cables should be shielded and insulated overall.

4. Power lines should be contained within the inspectable space whenever the average power load is less than 100 kVA. If this is not possible, the CTTA must conduct a review to detennine whether power line filters should be recommended. For existing facilities, the CTTA may request a TEMPEST test be peIfonned to assist in arriving at the recommendations.

5. RED processors should not be powered from the same circuits as RF transmitters or BLACK equipment with signal lines that exit the inspectable space, except when either the RED equipment or the RF transmitters and BLACKequipment with signal lines that exit the inspectable space are equipped with powerline filters. RED processors should be separated from RF transmitters by a minimum of three meters.

RECOMMENDATION C

Installing NSTISSAM TEMPEST/1-92 (Level III), Zone C or all other RED equipment . in a TEMPESTZone A Facility

(If not TEMPEST zoned, inspectable space less than 20 meters.)

Note: Ad.di1ional precautions may be necessary if the inspectable space is less than 8 meters.

Contact your CTrAfor specifIC guidance.

Note: These installations may create TEMPEST hazards. Contact your TEMPEST autlwrity for specific guidance.

1. A separation of one meter should be maintained between any RED processor and:

a. BLACKequipment (including administrative support equipment).

b. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

c. BLACKpower lines.

d. Fortuitous conductors that exit the inspectable space.

Note: if the separation cannot be maintained, the CTrA must conduct a review to determine whether filters or other countermeasures should be recommended. For existing facilities. the CTrA may request TEMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACKwire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACKpower lines.

Notes:

1. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire Lines should not use a common distribution vehicle.

3. RED and BLACK opticalfiber lines may use a common distribution vehicle providing that RED and BLACK opticalfiber lines are not mixed wiihin a multifiber cable: when a BLACKopticaLfibercable is used in a RED distribution vehicle. there should be an .

opaque dielectric sheath covering eachfiber and there should be no metallic stiffeners or metallic sheath in the BLACK opticaL.fiber cable. When a RED opticalfiber cable is used in a BLACK distribution vehicle. in addition to the above. the RED opticalfiber cable must be separated from the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectabLe space. if the RED opticalfiber cable exits the inspectable space, it must be provided appropriate protection (encryption. protected distribution systems IPDS}).

3. Shielded Cables.

a. RED processors meeting the requirements of NSTISSAM 1EMPEST /1-92 (Levels I. n.

or III) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification. or if specified for compliance with TEMPEST certification.

b. RED wire cables should be shielded and insulated overall.

4. Power lines should be contained Within the inspectable space whenever the average power load is less than 100 kVA If this is not possible. the CITA must conduct a review to detennine whether power line filters should be recommended. For existing facilities. the CITA may request a 1EMPEST test be peIfonned to assist in arriving at the recommendations.

5. RED processors should not be powered from the same circuits as RF transmitters or BLACK equipment with signal lines that exit the inspectable space. except when either the RED equipment or the RF transmitters and BLACKequipment with signal lines that exit the inspectable space are equipped with powerline filters. RED processors should be separated from RF transmitters by a minimum of three meters.

RECOMMENDATION D

Installing NSTISSAMTEMPEST/1-92 (Levell), Zone A RED Equipment In a TEMPEST Zone B Facility

(If not TEMPEST zoned, inspectable space greater than 20 meters but less than 100 meters.)

1. A separationof 50 centimeters should be maintained betweenany RED processorand:

a. BLACK wire lines that exit the inspectable spaceor areconnectedto an RF transmitter.

b. BLACK power lines.

Note: If the separation cannot be maintained, the CTTA must conduct a review to determine whether filters or other countermeasures should be recommended. For existingfacilities, the CTTA may request TEMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines.

Notes:

J. Separation distance should be increased to J5 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK optical fiber lines may use a common distribution vehicle providing that: RED and BLACK optical fiber lines are not mixed within a multifiber cable; when a BLACK optical fiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering each fiber and there should be no metallic stiffeners or metallic sheath in the BLACK optical fiber cable. When a RED optical fiber cable is used in a BLA CK distribution vehicle, in addition to the above, theREDoptical fiber cable must be separated from the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectable space. If the RED optical fiber cable exits the inspectable space, it must be provided appropriate protection (encryption, protected distribution systems [PDS}).

3. Shielded Cables. RED processors meeting the requirements ofNSTISSAM TEMPEST/I-92 (Levels I, II, or III) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification. .

FOR OFFICIAL USEONLY

RECOMMENDATION E

Installing NSTISSAMTEMPEST/1-92 (Level II),Zone B RED Equipment in a TEMPEST Zone B Facility

(It not TEMPEST zoned, inspectable space greater than 20 meters but less than 100 meters.)

1. A separation of 50 centimeters should be maintained between any RED processor and BLACK equipment (including administrative support equipment.)

2. A separation of one meter should be maintained between any RED processorand:

a. BLACK wire lines thatexit theinspectablespaceor areconnectedto an RF transmitter.

b. BLACK power lines.

Note: If the separation cannot be maintained, the CITA must conduct a review to determine whether filters or other countermeasures should be recommended. For existingfacilities, the CIT A may request TEMP EST tests be performed to assist in development of the recommendations.

3. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter

b. BLACK power lines.

Notes:

1. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK optical fiber lines may use a common distribution vehicle providing that: RED and BLACK optical fiber lines are not mixed within a multifiber cable; when a BLACK optical fiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering each fiber and there should be no metallic stiffeners or metallic sheath in the BLACK optical fiber cable. Where a RED opticalfiber cable is used in a BLACK distribution vehicle, in addition to the above, the, RED opticalfiber cable must be separated from the BLA CK distribution vehicle at the point where the BLA CK distribution vehicle exits the inspectable space. If the RED optical fiber cable exits the inspectable space, it must be provided appropriate protection (encryption, protected distribution systems [PDS}).

4. Shielded Cables. RED processors meeting the requirements ofNSTISSAM TEMPEST/1-92 (Levels I, II, or III) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

5. Power lines should be contained within the inspectable space whenever the average power load is less than 100 kVA. If this is not possible, the CTTA must conduct a review to detennine whether power line filters should be recommended. For existing facilities, the CTTA may request a TEMPEST test be perfonned to assist in aniving at the recommendations.

6. RED processors should not be powered from the same circuits as RF transmitters or BLACK equipment with signal lines that exit the inspectable space, except when either the RED equipment or the RF transmitters and BLACK equipment with signal lines that exit the inspectable space are equipped with powerline filters. RED processors should be separated from RF transmitters by a minimum of three meters.

RECOMMENDATION F

Installing NSTISSAMTEMPEST/1-92 (Level III),Zone C or all other RED equipment in a TEMPEST Zone B Facility

(IfnotTEMPESTzoned, inspectablespace greaterthan20 meters but less than 100meters.)

Note: These installations may create TEMPEST hazards. Contact your TEMPEST authority for specific guidance

1. A separation of one meter should be maintained between any RED processor and:

a. BLACK equipment (including administrative support equipment.)

b. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

c. BLACK power lines.

d. Fortuitous conductors that exit the inspectable space.

Note: If the separation cannot be maintained the CTTA must conduct a review to determine whether fitters or other countermeasures should be recommended. For existingfacilities, the CTTA may request TEMP EST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines.

Notes:

1. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK optical fiber lines may use a common distribution vehicle providing that: RED and BLACK optical fiber lines are not mixed within a multifiber cable; when a BLACK optical fiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering each fiber and there should be no metallic stiffeners or metallic sheath in the BLACK optical fiber cable. fJlhere a RED optical fiber cable is used in a BLACK distribution vehicle, in addition to the above, the, RED optical fiber cable must be separated from the BLA CK distribution vehicle at the point where the BLA CK distribution vehicle exits the inspectable space. If the RED optical fiber cable exits the inspectable space, it must be provided appropriate protection (encryption, protected distribution systems [PDSj).

3. Shielded Cables. RED processors meeting the requirements ofNSTISSAM TEMPEST/I-92 (Levels I, n, or ill) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

4. Power lines should be contained within the inspectable space whenever the average power load is less than 100 kVA. If this is not possible, the CTTA must conduct a review to determine whether power line filters should be recommended. For existing facilities, the CTTA may request a TEMPEST test be perfonned to assist in arriving at the recommendations.

5. RED processors should not be powered from the same circuits as RF transmitters or BLACK equipment with signal lines that exit the inspectable space, except when either the RED equipment or the RF transmitters and BLACK equipment with signal lines that exit the inspectable space are equipped with powerline filters. RED processors should be separated from RF transmitters by a minimum of three meters.

RECOMMENDATION G

Installing NSTISSAM TEMPEST/1-92 (Level I), Zone A RED Equipment in a TEMPESTZone C Facility .

(If not TEMPEST zoned, inspectable space greater than 100 meters.)

1. A separation of 50 centimeters should be maintained between any RED processor and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Note: lfthe separation cannot be maintained, the C1TA must conduct a review to determine whether filters or other coWl1ermeasures should be recommended. For existing facilities, the C1TA may request 1EMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Notes:

1. Separation distance should be increased to 15 centimeters for para1l£l runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK optical.fiber lines may use a common distribution vehicle providing that: RED and BLACK opticalfiber lines are not mixed wiihin a multifiber cable: when a BLACK optical.fiber cable is used in a RED distribution vehicle, there sfwuld be an opaque dielectric sheath covering each fiber and there should be no metallic stiffeners or metallic sheath in the BLACK optical.fiber cable. When a RED opticalfiber cable is used in a BLACK distribution vehicle, in addition to the above, the RED opticalfrber cable must be separatedjrom the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectable space. if the RED optical.fiber cable exits the inspectable space. it must be provided appropriate protection (encryption, protected distribution systems [PDS]J.

3. Shielded Cables. RED processors meeting the requirements ofNSTISSAM TEMPEST/I-92 (Levels I, II, or III) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification. or if specified for compliance with TEMPEST certification.

Tms PAGE IS INTENTIONALLYLEFT BLANK

- -- - -.----..- __.u _ _. __

RECOMMENDATIONH

Installing NSTISSAM TEMPEST/1-92 (Level II}, Zone B RED Equipment in a TEMPESTZoneC Facility .

(If not TEMPEST zoned, inspectable space greater than 100 m.)

1. A separation of one meter should be maintained between any RED processor and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Note: if the separation cannot be maintained. the C1TAmust conduct a review to detennine whether filters or other countermeasures should be recommended. For existing facilities, the C1TA may request TEMPEST tests be performed to assist in development of the recommendations.

2. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Notes:

1. Separation distance should be increased to 15 centimeters for parallELruns over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK opticalfiber lines may use a common distribution vehicle providing that: RED and BLACK opticalfiber lines are not mixed within a 1111Jl.t!fibercable: when a BLACK opticalfiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering eachfiber and there should be no metallic stiffeners or metallic sheath in the BLACK opticalfiber cable. When a RED optical fiber cable is used in a BLACK distribution vehicle, in addition to the above, the RED opticalftber cable must be separated from the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectable space. if the RED opticalfiber cable exits the inspectable space, it must be provided appropria:le protection (encryption, protected distribution systems [PDS]).

3. Shielded Cables. RED processors meeting the requirements ofNSTlSSAM TEMPEST/l-92 (Levels I. II. or III) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

4. Power lines should be contained within the inspectable space whenever the average power load is less than 100 kVA If this is not possible. the CTrA must conduct a review to determine whether power line filters should be recommended. For existing facilities. the CTrA may request a TEMPEST test be performed to assist in arriving at the recommendations.

5. RED processors should not be powered from the same circuits as RF transmitters or BLACK equipment with signal lines that exit the inspectable space, except when either the RED equipment or the RF transmitters and BLACKequipment with signal lines that exit the inspectable space are equipped with powerline filters. RED processors should be separated from RF transmitters by a minimum of three meters.

RECOMMENDATION I

Installing NSTISSAMTEMPEST/1-92 (Level III),Zone C or all other RED equipment in a TEMPEST Zone C Facility

(If not TEMPEST zoned, inspectable space greater than 100 meters.)

1. A separation of 50 centimeters should be maintained between any RED processorand BLACK equipment (including administrative support equipment.)

2. A separation of one meter should be maintained between any RED processorand:

a. BLACK wire lines that exit the inspectable spaceor are connectedto an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Note: If the separation cannot be maintained the CTTA must conduct a review to determine whether filters or other countermeasures should be recommended. For existingfacilities. the CTTA may request TEMPEST tests be performed to assist in development of the recommendations.

3. A separation of 5 centimeters should be maintained between any RED wire line and:

a. BLACK wire lines that exit the inspectable space or are connected to an RF transmitter.

b. BLACK power lines connected to an RF transmitter.

Notes:

I. Separation distance should be increased to 15 centimeters for parallel runs over 30 meters.

2. RED and BLACK wire lines should not use a common distribution vehicle.

3. RED and BLACK optical fiber lines may use a common distribution vehicle providing that: RED and BLA CK optical fiber lines are not mixed within a multifiber cable; when a BLACK optical fiber cable is used in a RED distribution vehicle, there should be an opaque dielectric sheath covering each fiber and there should be no metallic stiffeners or metallic sheath in the BLACK opticalfiber cable. Where a RED optical fiber cable is used in a BLACK distribution vehicle, in addition to the above, the, RED optical fiber cable must be separated from the BLACK distribution vehicle at the point where the BLACK distribution vehicle exits the inspectable space. If the RED optical fiber cable exits the inspectable space, it must be provided appropriate protection (encryption, protected distribution systems [PDSj).

4. Shielded Cables. RED processors meeting the requirements ofNSTISSAM TEMPESTI1-92 (Levels I, n, or Ill) must use optical or shielded wire cables if specified as part of the manufacturer's installation specification, or if specified for compliance with TEMPEST certification.

5. Power lines should be contained within the inspectable space whenever the average power load is less than 100 kVA. If this is not possible, the CTTA must conduct a review to determine whether power line filters should be recommended. For existing facilities, the CTTA may request a TEMPEST test be performed to assist in arriving at the recommendations.

6. RED processors should not…