Required TEMPEST Countermeasures Memorandum For Record.docx

DEPARTMENT OF THE AIR FORCE

HEADQUARTERS 62D AIRLIFT WING (AMC)

6 Nov 18

MEMORANDUM FOR WADS

FROM: 627 CS/SCXS

SUBJECT: Required TEMPEST Countermeasures

Need countermeasures for:

· VoIP separation

· Single classification and multiple classification KVMs and KMs

· The MVP’s control screen (HMI) is actually a Win 7 PC, it does not actually process data it just controls which feed the operator listens and talk through.

· Add separation requirements post optical isolation

1. Do not move any classified processing equipment from assigned locations. If equipment is moved, added, replaced, or removed validation will be voided. If changes need to be made coordinate with a Cybersecurity Office TEMPEST manager, so validation can be amended.

2. HQ AFCTTA validated AMC-McChord-137, 139, 140.

3. To view a full copy of your AF Form 4170 please contact the Cybersecurity Office

4. The following are TEMPEST countermeasures and precautions:

1. (U) COMMUNICATIONS SYSTEMS PRECAUTIONS.

1.1. (U) Cellular Personal Wireless Communication and/or other RF or Infrared (IR) wireless devices shall not be allowed into an area where classified is discussed or processed without the written approval from the DAA in consultation with the Cognizant Security Authority (CSA) Certified TEMPEST Technical Authority (CTTA). Wireless technology/devices used for storing, processing, and/or transmitting information shall not be operated in areas where classified information is electronically stored, processed or transmitted unless approved by the DAA in consultation with the CSA CTTA.

1.2. (U) AFSSI 7702 clearly states Air Force policy for cell phones with integrated digital camera capability. This guidance prohibits cell phones with integrated digital cameras within areas or in close proximity to equipment processing classified information. Individuals in possession of these cellular phones upon entry to Air Force facilities (a physically definable area that contains classified information-processing equipment) will be denied access to areas processing classified information. Signs will be posted to ensure all personnel are aware of this policy. Anyone found in possession of this type of cellular phone within Air Force classified areas or exiting these classified areas will have the phone confiscated and delivered to the Security Forces for disposition. Random inspections, ingress and egress, should be used as a means of oversight for this access restriction. (AFMAN 33-214 V1, Para. 3.6.6)

1.3. (U) No cell phones, cordless phones or microphones, wireless keyboards or mice, wireless Local Area Networks (LANs), or Infrared Local Area Networks (LANs) are allowed in areas where classified information is discussed or processed. “Area” refers to a room and/or to a space the size of a 3-meter radius sphere, centering on the classified source. In areas where classified information is discussed or processed, wireless pointer/mice devices are allowed for presentations only. (AFSSI 7702)

1.4. (U) All other wireless Personal Electronic Devices not specifically addressed above, that are used for storing, processing, and/or transmitting information shall not be operated in areas where classified information is electronically stored, processed or transmitted. (AFSSI 7702)

1.5. (U) As a general rule of thumb, do not bring handheld radios within 2 meters of RED processors without first consulting the Base EMSEC Office. Do not bring cordless telephones, cellular phones, microphones, wireless mice or keyboards, wireless local area networks (LANs), Infrareed LANs or devices, or other personal Electronic Devices (PEDs) within 3 meters of RED processors without first consulting the Base EMSEC Office.

1.6. (U) Transmitting Equipment: Separation guidance for fixed tranmitters and transceivers (transmitters and receivers contained in one unit) is based on the TEMPEST characteristics of the RED equipment. Separate RED equipment from transmitters by 5 meters. (AFSSI 7702, Paragraph 5.3.1.)

1.6.1. (U) Power Requirements: Do not power RED equipment from the same electrical circuit as radio frequency transmitters and any ancillary equipment, such as control heads, connected to radio frequency transmitters.(AFSSI 7702, Paragraph 5.3.1.)

1.7. (U) Hand-Held Radios: These countermeasures are required. Hand-held radio transceivers used with intrabase radios and land mobile radios (LMR) deserve special consideration because of their unique operational applications. A person may carry these portable radios in the standby mode, into an area where classified information is processed. Move away from classified processors prior to transmitting, 2 meters minimum. Base station LMR radios must be separated by a minimum of 2 meters from the classified processors. (AFSSI 7702, paragraph 5.4.2.)

1.8. (U) Remote Control Heads (AFSSI 7702, Paragraph 5.3.4.):

1.8.1 (U) Active Control Heads: Separate active control heads by 2 meters.

1.8.2 (U) Passive Control Heads: Separate passive control heads from RED equipment, RED wire lines, RED power lines, and RED signal ground lines by 0.5 meters.

2. (U) INFORMATION ASSURANCE SYSTEMS COUNTERMEASURES.

2.1. (U) Expose RED Signal Lines.

2.1.1. (U) This CAA is controlled 24/7, and has true floor-to-ceiling walls, therefore RED lines may be run beneath raised flooring and above the false ceiling. Check them for tampering twice a year or whenever uncleared personnel have had access to them (housekeeping, painting, CE work, etc.). (AFMAN 33-214 V1, paragraph 5.3.1.3)

2.2. (U) Prevent Crosstalk.

2.2.1. (U) Separate RED equipment from BLACK wire lines by 0.5 meters. (AFMAN 33-214 V1, paragraph 5.3.2.1)

2.2.2. (U) Do not let telephone instruments touch RED equipment. (AFMAN 33-214 V1, paragraph 5.3.2.2)

2.3. (U) Make sure that every signal line from a RED equipment is routed only to another RED equipment or is encrypted before connection to BLACK equipment. (AFMAN 33-214 V1, paragraph 5.3.3)

2.4. (U) Make sure all RED lines remain within the CAA or are secured before leaving the CAA. Secure them by using (listed by preference): cryptographic equipment, intrusion detection optical carrier system (IDOCS), or a protected distribution system (PDS). (AFMAN 33-214 V1, paragraph 5.3.4)

2.5. (U) Account for and maintain accountability of all RED lines. (AFMAN 33-214 V1, paragraph 5.3.5)

2.6. (U) Separate RED lines from BLACK lines by a distance sufficient to easily distinguish RED lines from BLACK lines. (AFMAN 33-214 V1, paragraph 5.3.6)

2.7. (U) Mark all RED lines with a 1-inch wide strip of red tape or re paint at intervals of approximately 1-1/2 meters. Do not mark RED lines less than 2 meters long unless they penetrate a wall, ceiling, or floor. (AFMAN 33-214 V1, paragraph 5.3.7)

2.8. (U) Separate Patch Panels. Separate RED and BLACK patch panels and connection facilities by 1 meter (e.g., distribution frames). (AFMAN 33-214 V1, paragraph 5.3.8)

2.9. (U) Control BLACK Magnetic Media.

2.9.1. (U) Either:

2.9.1.1. (U) Separate RED equipment from any BLACK tape players or recorders, BLACK wire lines, and BLACK power lines, (i.e.: audio [comfort music system], video [TV-VCR system], unclassified data recorders or players, etc.) by 10 meters. (AFMAN 33-214 V1, paragraph 5.3.9.1.1.3)

2.9.1.2. (U) AND, separate RED equipment from any BLACK magnetic media wire lines and power lines by 2 meters, (AFMAN 33-214 V1, paragraph 5.3.9.1.2)

2.9.1.3. (U) AND, separate any RED wire lines, RED power cords, and RED and BLACK signal ground wires 2 meters from BLACK magnetic media equipment, wire lines, and power cords. (AFMAN 33-214 V1, paragraph 5.3.9.1.3)

2.9.2. (U) OR, do not remove BLACK magnetic tapes from the facility. (AFMAN 33-214 V1, paragraph 5.3.9.1.3)

2.9.4. (U) OR, degauss BLACK magnetic tapes before removing them from the facility. (AFMAN 33-214 V1, paragraph 5.3.9.1.4)

2.9.5. (U) There are no separation requirements for CD players. (AFMAN 33-214 V1, paragraph 5.3.9.2)

2.9.6. (U) The decision to allow tapes into the facility is made by the security manager for the facility. (AFMAN 33-214 V1, paragraph 5.3.9.3)

2.9.7. (U) Separate RED equipment from BLACK equipment by 0.5 meters. (AFSSI 7702, Paragraph A14.3.2.1)

2.9.8. (U) Different categories of RED Local Area Networks (LAN), (SECRET Internet Protocol Router Network, North Atlantic Treaty Organization, Coalition, etc.) must adhere to the same separation requirements for components and wiring as RED/BLACK LANs.

2.9.9. (U) Even though monitors are considered as RED or BLACK equipment, the separation distance between the RED monitors and BLACK monitors can be reduced to a minimum of 5 centimeters (2 inches) separation from each other. Separation between the RED monitor (including its associated RED line) and other BLACK wirelines, equipment, and/or fortuitous conductors follow standard separation guidance, with a minimum of 0.5 meters (20 inches) separation distance. (ESIM 2010-02, Paragraph 4.11.)

5.2. (U) CRYPTOGRAPHIC EQUIPMENT REQUIRED COUNTERMEASURES

5.2.1. (U) KG-175 (TACLANE) required countermeasures:

5.2.1.1. (U) Do not use the computer’s internal modem; use an external modem. Install a power line filter for the BLACK power if the power distribution facility is located outside the inspectable space.

5.2.1.2. Connect the TACLANE/FASTLANE to BLACK power.

5.2.1.3. The TACLANE/FASTLANE is designed for use with vendor provided shielded cables. If vendor provided cables are not used, shield both the RED and BLACK wire lines. Connect the shields to the appropriate RED and BLACK signal grounds. The shields from these cables are grounded through the connector back shell to the appropriate ground in the equipment. For the purpose of brevity, the below listed TACLANE models will further be known as “TACLANE”:

· TACLANE E-100 Encryptor (KG-175),

· TACLANE-GigE (KG-175A),

· TACLANE-Mini (KG-175B),

· TACLANE-Micro (KG-175D),

· TACLANE-Router

· STU-III, STE, etc.

5.2.1.4. RED and BLACK signal grounds are not required except for facilities where the signal ground is not totally contained within the inspectable space. Use RED and BLACK signal grounds if already installed and are within 10 meters of the cryptographic equipment. A longer length of wire could cause undesirable ground loops.

5.2.2.5. As a minimum, separate the TACLANE/FASTLANE from:

5.2.2.5.1. RED and BLACK equipment by 5 centimeters (cm), approx. 2.5 inches.

(Note: RED processors still require 0.5 meter minimum separation from BLACK equipment and wire line)

5.2.2.5.2. Other TACLANE/FASTLANE encryptors by 5 cm.

5.2.2.5.3. Other equipment power lines by 5 cm.

5.2.2.5.4. Shielded RED and BLACK wire lines by 5 cm. There is no requirement to separate fiber wire lines from the TACLANE/FASTLANE.

5.2.2.5.5. Unshielded RED and BLACK wire lines by 15 cm.

5.2.2.6. Separate from each other, the RED and BLACK cables connected to the TACLANE/FASTLANE by 5 cm.

5.2.2.7. Separate the TACLANE/FASTLANE from RED and BLACK patch panels and connection facilities, such as distribution frames, by 5 cm.

5.2.2.8. Separate the TACLANE/FASTLANE 5 cm from any modem.

5.2.3. (U) All Other Cryptographic Equipment:

5.2.3.1. (U) These countermeasures are required. In a facility where all the equipment on the RED side of the cryptographic equipment is considered RED, the installation of the cryptographic equipment must follow the installation standards in the technical publications related to the cryptographic equipment. If not specified, the following countermeasures are required:

5.2.3.1.1 (U) Do not use the computer’s internal modem; use an external modem. (AFSSI 7702,Para. 6.8.1)

5.2.3.1.2. (U) Connect the cryptographic equipment to BLACK power. Shield the BLACK power distribution facility when not costly. (AFSSI 7702, Para. 6.8.2)

5.2.3.1.3. (U) Shield both the RED and BLACK wire lines. Connect the shields to the appropriate RED and BLACK signal grounds. Cryptographic equipment is designed for use with shielded cables. The shields from these cables are grounded through the connector backshell to the appropriate ground in the equipment. (AFSSI 7702, Para. 6.8.3)

5.2.3.1.4. (U) RED and BLACK signal grounds are not required except for facilities where the signal ground is not totally contained within the inspectable space. Use RED and BLACK signal grounds if already installed and are within 10 meters of the cryptographic equipment. (AFSSI 7702, Para. 6.8.4)

5.2.3.1.5. (U) Separate cryptographic equipment from:

5.2.3.1.5.1. (U) RED equipment and BLACK equipment by 1 meter. Separate cryptographic equipment from:

5.2.3.1.5.2. (U) TEMPEST-certified equipment by 5 centimeters. (AFSSI 7702, Para.6.8.5.1)

5.2.3.1.5.3. (U) Power lines by 5 centimeters. (AFSSI 7702, Para. 6.8.5.2)

5.2.3.1.5.4. (U) RED and BLACK wire lines by 5 centimeters. (AFSSI 7702, Para. 6.8.5.3)

5.2.3.1.6. (U) Separate the RED and BLACK cables connected to the cryptographic equipment by 5 centimeters.

(AFSSI 7702, Para. 6.8.6)

5.2.3.1.7 (U) Separate RED and BLACK patch panels and connection facilities by 1 meter (e.g., distribution frames). (AFSSI 7702, Para. 6.8.7)

5.2.4. (U) Secure Telephone Unit-III (STU-III), Secure Terminal Equipment (STE), and Like Items.

Missing this important statement: These countermeasures are required for STU-III, STE, and secure data devices (SDD). Do the following when connecting ancillary items such as computers and facsimile (FAX) machines to the secure digital data port:

5.2.4.1. (U) Separate the STU-III, STE, or SDD 1 meter from the RED equipment. (AFSSI 7702, Para. 6.3.1)

5.2.4.2. (U) Use the manufacturers’ shielded cable to connect the STU-III, STE, or SDD to the RED equipment. If the manufacturer’s shielded cable is not available, use a generic shielded cable. (AFSSI 7702, Para.6.3.2)

ADD 5.2.4.2. (U) For secure voice see paragraph 10.58.

5.2.5. (U) Separate SDAP from all other equipment by 15 centimeters.

ADD 10.58. Secure Telephones. Generally, the STU-III and the STE are considered BLACK telephones and treated as such. However, when a FAX machine, PC, or other device processing classified information is connected to the secure digital data port, include the STU-III or STE in the EMSEC assessment of the whole system. Treat the STU-III or STE as cryptographic equipment and make a cryptographic equipment countermeasures review.

Unrivaled Global Reach For America…ALWAYS!

image1.emf image2.jpeg