RECOMMENDATION G
Installing NSTISSAM TEMPEST/1-92 (Level I), Zone A RED Equipment
in a TEMPEST Zone C Facility
(If not TEMPEST zoned, inspectable space greater than 100 meters.)
1. A separation of 50 centimeters should be maintained between any RED processor
and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Note: If the separation cannot be maintained, the CTTA must conduct a
review to determine whether filters or other countermeasures should be
recommended. For existing facilities, the CTTA may request TEMPEST tests
be performed to assist in development of the recommendations.
2. A separation of 5 centimeters should be maintained between any RED wire
line and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Notes:
1. Separation distance should be increased to 15 centimeters for parallel
runs over 30 meters.
2. RED and BLACK wire lines should not use a common distribution
vehicle.
3. RED and BLACK optical fiber lines may use a common distribution vehicle
providing that: RED and BLACK optical fiber lines are not mixed within a
multifiber cable; when a BLACK optical fiber cable is used in a RED distribution
vehicle, there should be an opaque dielectric sheath covering each fiber
and there should be no metallic stiffeners or metallic sheath in the BLACK
optical fiber cable. When a RED optical fiber cable is used in a BLACK
distribution vehicle, in addition to the above, the RED optical fiber cable
must be separated from the BLACK distribution vehicle at the point where
the BLACK distribution vehicle exits the inspectable space. If the
RED optical fiber cable exits the inspectable space, it must be provided
appropriate protection (encryption, protected distribution systems
[PDS]).
3. Shielded Cables. RED processors meeting the requirements of NSTISSAM TEMPEST/
1-92 (Levels I, II, or III) must use optical or shielded wire cables if specified
as part of the manufacturer's installation specification, or if specified
for compliance with TEMPEST certification.
THIS PAGE IS INTENTIONALLY LEFT BLANK
RECOMMENDATION H
Installing NSTISSAM TEMPEST/1-92 (Level II), Zone B RED Equipment
in a TEMPEST Zone C Facility
(if not TEMPEST zoned, inspectable space greater than 100 m.)
1. A separation of one meter should be maintained between any RED processor
and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Note: If the separation cannot be maintained, the CTTA must
conduct a review to determine whether filters or other countermeasures should
be recommended. For existing facilities, the CTTA may request TEMPEST tests
be performed to assist in development of the recommendations.
2. A separation of 5 centimeters should be maintained between any RED wire
line and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Notes:
1. Separation distance should be increased to 15 centimeters for parallel
runs over 30 meters.
2. RED and BLACK wire lines should not use a common distribution
vehicle.
3. RED and BLACK optical fiber lines may use a common distribution vehicle
providing that: RED and BLACK optical fiber Lines are not mixed within a
multifiber cable; when a BLACK optical fiber cable is used in
a RED distribution vehicle, there should be an opaque dielectric sheath covering
each fiber and there should be no metallic stiffeners or metallic sheath
in the BLACK optical fiber cable. When a RED optical fiber cable is used
in a BLACK distribution vehicle, in addition to the above, the RED optical
fiber cable must be separated from the BLACK distribution vehicle at the
point where the BLACK distribution vehicle exits the inspectable space. If
the RED optical fiber cable exits the inspectable space, it must be provided
appropriate protection (encryption, protected distribution systems
[PDS]).
3. Shielded Cables. RED processors meeting the requirements of NSTISSAM
TEMPEST/1-92 (Levels I, II, or III) must use optical or shielded wire cables
if specified as part of the manufacturer's installation specification, or
if specified for compliance with TEMPEST certification.
4. Power lines should be contained within the inspectable space whenever
the average power load is less than 100 kVA. If this is not possible. the
CTTA must conduct a review to determine whether power line filters should
be recommended. For existing facilities, the CTTA may request a TEMPEST test
be performed to assist in arriving at the recommendations.
5. RED processors should not be powered from the same circuits as RF transmitters
or BLACK equipment with signal lines that exit the inspectable space. except
when either the RED equipment or the RF transmitters and BLACK equipment
with signal lines that exit the inspectable space are equipped with powerline
filters. RED processors should be separated from RF transmitters by a minimum
of three meters.
RECOMMENDATION I
Installing NSTISSAM TEMPEST/1-92 (Level III), Zone C or all other RED
equipment
in a TEMPEST Zone C Facility
(If not TEMPEST zoned, inspectable space greater than 100 m.)
1. A separation of one meters should be maintained between any RED processor
and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Note: If the separation cannot be maintained the CTTA must
conduct a review to determine whether filters or other countermeasures should
be recommended. For existing facilities, the CTTA may request TEMPEST tests
be performed to assist in development of the recommendations.
2. A separation of 5 centimeters should be maintained between any RED wire
line and:
a. BLACK wire lines that exit the inspectable space or are connected to an
RF transmitter.
b. BLACK power lines connected to an RF transmitter.
Notes:
1. Separation distance should be increased to 15 centimeters for parallel
runs over 30 meters.
2. RED and BLACK wire lines should not
use a common distribution vehicle.
3. RED and BLACK optical fiber lines may use a common distribution vehicle
providing that: RED and BLACK optical fiber Lines are not mixed within a
multifiber cable; when a BLACK optical fiber cable is used in
a RED distribution vehicle, there should be an opaque dielectric sheath covering
each fiber and there should be no metallic stiffeners or metallic sheath
in the BLACK optical fiber cable. When a RED optical fiber cable is used
in a BLACK distribution vehicle, in addition to the above, the RED optical
fiber cable must be separated from the BLACK distribution vehicle at the
point where the BLACK distribution vehicle exits the inspectable space. If
the RED optical fiber cable exits the inspectable space, it must be provided
appropriate protection (encryption, protected distribution systems
[PDS]).
3. Shielded Cables. RED processors meeting the requirements of NSTISSAM TEMPEST/
1-92 (Levels I, II, or III) must use optical or shielded wire cables if specified
as part of the manufacturer's installation specification, or if specified
for compliance with TEMPEST certification.
4. Power lines should be contained within the inspectable space whenever
the average power load is less than 100 kVA. If this is not possible, the
CTTA must conduct a review to determine whether power line filters should
be recommended. For existing facilities, the CTTA may request a TEMPEST test
be performed to assist in arriving at the recommendations.
5. RED processors should not be powered from the same circuits as RF transmitters
or BLACK equipment with signal lines that exit the inspectable space, except
when either the RED equipment or the RF transmitters and BLACK equipment
with signal lines that exit the inspectable space are equipped with powerline
filters. RED processors should be separated from RF transmitters by a minimum
of three meters.
GUIDANCE FOR TEMPEST INTEGRITY
4.1. General. This section briefly describes the TEMPEST
phenomena and the basic installation criteria to achieve TEMPEST integrity
of national security information processing equipment and systems. The other
appendices in this document contain specific installation and countermeasures
guidance for various systems. NACSIM 5000 has additional information on the
sources of TEMPEST signals, the types of TEMPEST signals, and the methods
of signal propagation.
4.2. TEMPEST Basics. TEMPEST is an unclassified short
name referring to investigations and studies of Compromising Emanations (CE).
CE are defined as unintentional data related or intelligence bearing signals,
which if intercepted and analyzed, disclose the NSI transmitted, received,
handled, or otherwise processed by any information processing equipment.
These intercepted signals need not be of great magnitude to compromise the
NSI. Receiving intercept instruments can make use of even a small amount
of energy.
4.2.1. Generation of CE. When equipment process NSI,
the possibility exists that CE can be generated. Time and frequency
characteristics of these emanations are normally unknown. However, the mechanisms
of NSI emanation introduction into an escape medium, characteristics of various
equipment under test, and experience allow estimation of their characteristics.
In practice the more common types of CE are attenuated RED baseband signals,
spurious carriers modulated by RED baseband signals, and impulsive
emanations.
4.2.2. CE Sources. To determine the extent of CE and
the necessary countermeasures to apply, equipment must be considered individually
and as components of a system. Any circuit processing NSI can be a source
of CE. A system could emit signals beyond the defined boundaries, even when
all equipment and components comprising the system individually meet TEMPEST
standards. This could occur because of the interrelationship of components,
equipment interface characteristics, lengths, locations and shielding of
interconnecting signal and control lines and methods of grounding each unit
within the system. There are two basic sources of CE:
4.2.2.1. Functional Sources. Functional sources are those
designed for the specific purpose of generating electromagnetic energy. Examples
are switching transistors, oscillators, signal generators. synchronizers,
line drivers and line relays.
4.2.2.2. Incidental Sources. Incidental sources are those
NOT designed for the specific purpose of generating electromagnetic energy,
but can generate energy incidental to normal operations. These sources of
CE can include all electromechanical and electronic equipment and systems
used to process NSI (e.g., communications equipment, recording and duplicating
equipment. automatic data processing equipment. and their
installations).
4.3. RED/BLACK Basics. The RED/BLACK concept. by definition,
establishes areas for placement of equipment processing NSI (RED) that are
separate and unique from areas with equipment processing non-NSI (BLACK).
The concept is composed of two parts: physical separation and electrical
separation.
a. Physical Separation. All equipment, wirelines, components
and systems that process NSI are considered RED. All equipment, wirelines.
components and systems that process encrypted NSI and non-NSI are considered
BLACK The RED/BLACK concept is to establish minimum guidance for physical
separation to decrease the probability that electromagnetic emissions from
RED devices might couple to BLACK systems. Section 3 specifies the recommended
separation for different equipment.
b. Electrical Separation. Electrical separation ensures that every
signal conductor from a RED device is routed only to another RED device,
or is encrypted before connection with a BLACK device. Electrical separation
addresses signal distribution, power distribution, and grounding. Switches
and/or other devices used to interface between RED and BLACK circuits/equipment
should exhibit the following port-to-port isolation characteristics, as
applicable:
-
100 dB over the baseband audio frequency range between 0.3 and 15 kHz.
-
80 dB over the baseband video frequency range up to 5 MHz.
-
60 dB over the frequency range from one times
(Rd) to ten times
the basic data rate (10Rd) of the digital signal(s)
processed.
4.3.1. Facility Considerations. The most cost-effective application
of RED/BLACK countermeasures will vary depending on characteristics of the
facility and the equipment operated within the facility. The first step in
the selection of proper RED/BLACK controls for the facility is the identification
of the facility TEMPEST Zone ratings, equipment TEMPEST Zone ratings. and
facility inspectable space. Table 3-1 and Section 3 contain the RED/BLACK
installation recommendations as a function of these variables.
4.3.2. Physical Security Considerations. Physical security is a key
element in deciding what RED/BLACK countermeasures will be adopted and is
an important part of the necessary safeguards for equipment and systems that
process NSI. The user is responsible for adopting the requisite physical
security standards and procedures according to current directives. Physical
security should be addressed at the beginning of any new facility or renovation
project. Security officials, the CTTA. and/or others responsible for building
construction or modification should be involved during the planning stages
of a project.
4.4. Signal Cables. Installations can use shielded metallic cables
and nonmetallic optical fiber cables to interconnect signals and to meet
RED/BLACK separation recommendations.
4.4.1. Shielded Metallic Cables. Selection of metallic cable types
varies according to equipment design. Jacketed multiconductor twisted pair
cables consist of insulated, shielded pairs, or a bundle of twisted pairs
contained within a single shield. Each shield (of a twisted pair or bundle
of twisted pairs) should include an uninsulated and tinned drain wire. This
drain wire should have a lay such that it will contact the shield
throughout its length. To reduce radiation of CE, metallic cables should
have a minimum of one overall braided metallic shield, with the shield terminated
at both ends to the grounding network. The shield should not be used as a
signal return path. A drain wire is not required in braided copper or
outside-plant-type aluminum foil shielded telephone cable.
4.4.1.1. Cable Characteristics. Cables should have an overall shield
composed of 85 to 90 percent tinned copper braid coverage. Consider the following
when selecting cables: voltage breakdown, insulation type, jacket material
and color. Effective shielding for a cable is achieved by meeting the
requirements of MIL-C-23437 and by using proper cable shield termination.
Crosstalk can appear on adjacent pairs. Refer to MIL-C-23437 for specific
measurement techniques.
4.4.1.2. Shield Termination. Both ends of the overall shield should
have 360 degree terminations. Shields for twisted pairs and bundles of twisted
pairs are normally terminated at both ends. Designers and installers must
be aware that terminating cable shields at both ends can cause signal ground
loop problems resulting in TEMPEST emanations or safety concerns. In these
cases, the designers and installers should consider terminating the cable
shield at one end only, or replacing the cable with a nonmetallic optical
fiber cable. Long pigtail and long ground wire shield terminations drastically
reduce shielding effectiveness and in certain frequency ranges can completely
nullify the inherent shielding capability of a cable. If pigtail termination
is required, the pigtail should be as short as possible and should be bonded
to a low impedance radio frequency ground such as ground, plate, chassis
or wide ground bus. A long slender ground wire is not an effective RF ground
and can instead be an effective antenna.
4.4.2. Optical Fiber Cables. A fiber
optics system converts an electrical signal to an optical signal, transmits
the signal through an optical fiber, and converts the signal to an electrical
signal at the receive end of the fiber. Although optical converters can create
TEMPEST emanations from the electrical portion of their circuitry, optical
systems have several advantages over metallic signal cables when used to
transmit RED information:
-
Because optical fibers are nonmetallic, they do not conduct or radiate radio
frequency interference (RFI). Optical fibers are virtually unaffected by
electromagnetic fields (i.e., electromagnetic interference (EMI) or RFI),
effectively eliminating cable crosstalk.
-
Because there are no cable grounds, systems are not subject to ground loops.
-
Optical fiber cable systems are not subject to the transmission of common
mode signals.
-
Optical fiber cable systems are not damaged from lightning strikes through
the optical fiber cable, although the cable can be severed.
4.4.2.1. Applications of Optical Fiber Cable
Systems. Optical fiber cable systems can be used
in RED and BLACK distribution systems to prevent the unintended transmission
of TEMPEST signals outside the inspectable space. Specific optical systems
can also be approved as a PDS (see current PDS standard) for secure transmission
of plain text NSI to remote areas of the same security classification. While
optical fiber cables used for this purpose will not radiate CE, the cables
are still vulnerable to tampering, requiring appropriate physical security
as with any RED cable. See MIL-STD-188-111 for interoperability and performance
standards of optical fiber cable systems for military application.
4.4.2.2. Multifiber Cables. Multifiber
cables within the same cladding should be restricted to either RED or BLACK
information to preclude compromise through misconnections. Separate RED and
BLACK dielectric multifiber cables can be routed in a common RED distribution
system provided the end equipment are managed to preclude misconnections.
All optical fiber cables should be clearly marked, labeled or tagged as RED
or BLACK according to purpose to maintain complete accountability. Unused
optical fiber cables should be marked as such.
4.4.2.3. Cable Strength Members or
Shielding. A strength member included in some
multifiber cables can be made of steel or other metal. Such a metal
component in the cable could be a fortuitous conductor. Therefore, treat
RED optical fiber cables with metal strength members and/or conductive shielding
(cladding) the same as metal lines. They should not traverse BLACK areas
unless installed in an approved PDS system.
4.5. Signal Distribution. A signal
distribution system provides for the routing of BLACK or RED cables and consists
of wireways and interconnect facilities. The typical encrypted communications
system requires an interconnect medium to connect the terminal equipment
to the encryption device, the encryption device to the modulator-demodulator
(modem), and the modem to the line or carrier equipment. This medium
is usually a technical control or patch and test facility containing patching
and distribution equipment. The signal distribution design should.
-
Provide an orderly scheme to route signal cables among and between equipment
by using good engineering practices.
-
Provide accountability for all signal cables with sound administrative and
operational accounting.
-
Prevent RED cables from becoming intermixed or inadvertently coupled to any
BLACK cables by selection of cables, wireways, interconnect facilities, and
isolation techniques.
4.5.1. Wireways. Wireways provide convenient methods
to control the routing of signal cables to prevent mixing cables by controlling
access to the route. Properly installed wireways can also aid in shielding
cables contained therein and thereby reducing electromagnetic radiation.
RED and BLACK cables should use separate wireways with physical separations
as recommended in Section 3. Many signal lines that egress the inspectable
space are contained in a pipe, conduit. duct or other conductive material.
This outer physical layer can become a fortuitous conductor and could require
isolation. A CTTA will determine if isolation is required. the best location
for the break and the length of pipe.
4.52. Patching Equipment. Patching equipment is usually
a series of jack fields wired in the normal through configuration. This permits
equipment to be connected through all elements to the line or carrier equipment.
Patch cords enable use of spare equipment or cable pairs when performing
routine maintenance or eliminate downtime due to equipment or wiring
malfunctions. Install separate RED and BLACK jack fields to maintain the
separation recommendation of Section 3. The jack fields should have incompatible
connectors to prevent inadvertent RED to BLACK patching. Separate the cabinets
or racks from RED and BLACK equipment according to Section 3.
4.5.3. Distribution Equipment (Wire Closets). Wire closets
typically are equipment cabinets or rooms designed for hardwired interconnect
of cables between equipment. Distribution equipment must be designed with
separate RED and BLACK connector blocks to prevent improper connection of
RED and BLACK lines. Separation of the connection components and the associated
signal line distribution should be according to Section 3.
4.5.4. Protected Distribution Systems (PDS). A signal
distribution system containing unencrypted NSI which enters an area of lesser
classification, an unclassified area or uncontrolled (public) area must be
protected according to the requirements of the current PDS standard.
4.6. Signal Line Isolators and Filters.
4.6.1. Signal Line Isolation. BLACK lines and other
electrically conductive materials that egress the inspectable space are potential
carriers of CE that can inadvertently couple to the lines. An extensive variety
and quantity of BLACK lines and other conductive materials can cross the
boundary of the inspectable space of a facility. Various signal line isolation
techniques can be used to protect the signal line, the distribution system
or other fortuitous conductors from conducting compromising signals beyond
secure areas. Before employing these isolation methods, the facility and
equipment should be evaluated to determine if the minimum separation
recommendations of Section 3 can be met. Consider signal line isolation only
if the minimum separation recommendations cannot be met.
4.6.2. Assessing the Need for Signal Isolation. When the minimum
separation recommendations of Section 3 cannot be met, there are many factors
that combine to determine if a specific facility and equipment complement
should use signal line isolation techniques. The CTTA should decide whether
compromising signals are detectable on the signal lines in areas where
unauthorized personnel could exploit them with little chance of being discovered.
Without knowledge of the results of an instrumented TEMPEST test at the site,
there will usually be insufficient information to make this decision. Experienced
TEMPEST personnel can decide based on known factors that can include equipment
TEMPEST characteristics, cable shielding, equipment separation distances
from the potential conductors, physical access controls to the distribution
of the conductors, the security classification of the NSI processed, and
the relative threat of exploitation based on the geographic location of the
facility, and the guidelines of NSTISSI 7000. To ensure that the facility
is adequately protected for future equipment configurations, consider the
frequency of changing, adding and relocating equipment. At a specific facility
some conductors require isolation while others do not, based on equipment
layout, signal line distribution and other factors. Isolation of conductors
may not be possible for reasons like life, safety or prohibitive cost. When
conflicts occur, consult the cognizant CTTA to develop the best approach.
4.6.3. Passive Signal Line Filters. Passive filters are installed
on signal lines to block signals outside a specified frequency range. Lowpass
filters are used to pass the intended baseband signal and greatly attenuate
all higher frequency signals. Bandpass filters, which suppress signals above
and below a specified frequency range, and highpass filters, which pass signals
above a specified frequency, are also available for special requirements.
Filters are available with different signal cutoff frequencies to meet the
requirements of a variety of signaling rates. Previously, telephone line
filters were required to pass only the analog voice signals. To avoid signal
degradation or stoppage in digital data transmission on telephone networks,
select telephone line filters compatible with the format and speed of the
intended signal.
4.6.3.1. Lowpass Filters. Passive lowpass signal line filters should
meet the guidance below and the requirements of MIL-F-15733. For most effective
performance, signal line filter design should meet the specific requirements
for their particular application, however, an existing filter design that
approximates the desired characteristics can be more economical. Two types
of signals require filtering: analog signals (i.e., voice or the tone output
of modems), and digital signals (i.e., mark/space square waves). Filter behavior
and performance for each of these types of signals are considered separately.
4.6.3.1.1. Analog Signal line Filters. Analog signal line filters
are usually designed to match a balanced 600 ohm signal pair (two 300 ohm
filters). These filters can introduce moderate phase and amplitude perturbations
in the 1500 Hz to 3300 Hz portion of the passband, even when employed in
an impedance matched system. If there is an impedance mismatch to the filter,
these perturbations will increase approximately in proportion to the extent
of the mismatch. Modems can tolerate a minimum of phase and amplitude distortion
introduced by signal line filters. For applications of this type, the options
are to use a simple filter designed to introduce minimal phase and amplitude
distortion in the frequency band of the modem (0 to 3300 Hz) or to design
an expensive, multi-element, compensated filter.
4.6.3.1.2. Inductive-Capacitive (LC) Signal Line Filters. LC signal
line filters tend to "ring" when the input signal is a square wave. Using
these filters to remove undesired frequency components from digital signals
generate stringent design problems. The best square wave performance can
be obtained from an LC filter that is both driven and terminated in its
characteristic impedance. Some ringing will occur, and there will be 6 dB
attenuation of the signaling voltage (i.e.. +6 volts to the filter driver
will produce +3 volts out to the line). This degree of signal attenuation
is usually not acceptable in a digital system. Two alternate approaches are
available to provide minimum desired signal attenuation, with only a moderate
increase in ringing. First, a filter driven with a matched source impedance
can be terminated in a high impedance (x10 or higher) without appreciable
signal attenuation and with only a moderate increase in ringing. Second.
when an inductance input type filter is employed, a low impedance device
can be used if the filter is terminated in its characteristic impedance.
In general, a filter terminated in its characteristic impedance can be used
at a bit rate approaching 1/3 the filter cutoff frequency. If the impedance
is substantially mismatched, excessive ringing will occur and the bit rate
that can be passed is drastically reduced.
4.6.3.1.3. Digital Signal Line Filters. Filters driven
directly from keying contacts must have inductive inputs or there will be
excessive contact arcing resulting in rapid contact deterioration. Ringing
will be moderate if the filter is terminated in its characteristic impedance.
Without proper termination. the filtered signal will have excessive ringing
that severely limits the usable bit rate. Filter designs developed to solve
specific problems are necessarily expensive. Changing the signal patch to
provide a balanced signal pair matching the characteristic impedance of a
filter is usually impossible. Most signal line filters are designed for balanced
600 ohm transmission line systems and are available as either dual 300 ohm
or 300 ohm units intended to be used in pairs. They have also been designed
primarily for analog signals in the 0 to 3 kHz frequency range. Unfortunately,
these filters have been employed in many digital applications for which they
were not designed. Most digital systems do not employ balanced transmission
techniques in that one lead of a transmission pair is driven at 6 volts for
space bits, and 0 volts for mark bits. Also, the input impedance of low level
digital devices usually is at least 6,000 ohms and can be as high as 100,000
ohms, while the output driving impedance of digital drivers can be only a
few ohms. This suggests that 300 ohm analog filters will give unsatisfactory
performances in most digital circuits. If filtering is necessary for specific
digital applications, special filter designs should be developed that are
tailored to the specific problem. An alternative is to change the signaling
path to a transmission link using a balanced signal pair with matched source
and sink impedances. A standard filter can then be inserted in the transmission
link. This alternative is particularly attractive from an engineering viewpoint
when the signaling path leaves the inspectable space for a long run.
4.6.4. Active Signal Line Filters. Active filters are
frequency selective devices that employ electronic impedance, current, and
voltage modifying elements, requiring the application of power to use their
filtering properties. As opposed to passive filters, active filters are
essentially one-way devices that use impedance mismatch as the primary basis
for filtering action. Note also that the phase delay. passband. and stop
band characteristics of active filters can be widely divergent from those
of standard passive filters. Active filters are more readily adaptable to
digital applications than are passive filters and can be specifically designed
to process analog signals with a minimum of distortion.
4.6.4.1. Linear Filters. Active linear filters normally
consist of linear amplifiers that incorporate frequency selective
resistance-capacitance (RC) networks, either as negative feedback elements
or in line filter elements, or both. Filters of this type can be configured
to be lowpass, bandpass, highpass, or band rejection types. A well-designed
active filter provides a greater degree of attenuation of unwanted signals
at a higher cost. The small size and versatile characteristics can justify
the added cost. Active filters are currently being produced in modular form
to produce chips that offer a greater variety of filtering
characteristics.
4.6.4.2. Saturated Amplifiers. One type of active filter
for digital signals is a combination of saturated input and output amplifiers
coupled by means of a single RC network. If an active feed through capacitor
is employed between the input and the output compartments, independent power
supply provided. and adequate shielding designed into the enclosure, attenuation
of transverse mode unwanted signals of at least 100 dB can be obtained. Saturated
amplifiers should not be used by themselves because they do not provide
common mode isolation. The provision of an optical path instead of
a conducted or capacitive penetration of the RED/BLACK shield adds minimum
complexity and enhances security.
4.6.5. Isolators. The common characteristic of isolators is that they
can provide dc and ground system isolation between input and output circuits,
thus reducing the possibility of signal conducting ground loops. Isolators
also offer design possibilities for non-low level signals in and low level
signals out. or vice versa, polar-to-neutral-to-polar conversion, and independent
dc levels for input and output circuits. To obtain these characteristics,
separate power sources are necessary for input and output circuits. Isolators
can be subdivided into the following functional types: magnetic-, acoustic-.
and photon-coupled devices.
4.6.5.1. Magnetic-coupled Isolators. The simplest form of a
magnetic-coupled isolator is a conventional electromechanical relay. Such
a device provides dc isolation, but is limited to low baud rates, and unless
it is of a very special shielded design, provides only meager higher frequency
attenuation. Another form of magnetic-coupled isolator is the transformer-coupled
type that employs a modulated oscillator in the input operating at a frequency
at least ten times the highest baud rate, while the output is equipped with
either a suitable phase, frequency shift, or amplitude detector. Effective
passive filtering of the input and output signal lines is essential to prevent
the modulated high frequency signal from coupling out of the isolator onto
the input and output lines. Standard relays have been used as isolators in
teleprinter (TTY) systems for many years, but their principal capability
has been dc isolation and level changing. Transformer-coupled isolators have
not been highly successful as digital devices, but as analog devices. transformer
coupling is used extensively to provide dc isolation between equipment and
balanced input and output lines.
4.6.5.2. Acoustic-coupled Isolators. Acoustic-coupled isolators are
similar to transformer-coupled isolators in that both employ a modulated
oscillator and suitable detecting devices. In the acoustical device, the
oscillator drives a transducer, which in turn excites a receiving transducer
through some nonconducting medium. The problems encountered with this type
isolator are similar to those of the magnetic-coupled type. Very few applications
of this type device have been achieved.
4.6.5.3. Photon-coupled Isolators. Photon-coupled (optical) isolators
are available in many different configurations. These range from integrated
circuit components (containing a light source and detector and providing
only dc and very low frequency isolation) to isolators that employ optical
coupling through a waveguide (capable of providing more than 120 dB of both
common mode and transverse mode isolation from dc through 10 GHz. This definition
applies to both forward and backward (output-to-input) isolation. Common
mode signal isolation is the degree of signal attenuation in decibels between
the shorted input and the shorted output of the isolation device when the
signal source is between the shorted input of the isolation device and ground
reference. The measuring equipment is connected between the shorted output
and the ground reference. Photon-coupled isolators are available for both
digital and analog signal applications. Digital signaling speeds of several
million bits per second and analog bandwidths of several megahertz can be
accomplished. Photon-coupled isolators use lightwave technologies to couple
signals between two points via use of an optical fiber cable. When the optical
fiber cable is installed in a waveguide beyond cutoff, the isolator is ideal
for use in shielded installations where conducting penetrations are kept
at a minimum. Four types of isolators are identified by intended application.
Type |
Application |
I |
digital signals without retiming input (regeneration) |
II |
digital signals with retiming input (regeneration) |
III |
analog signals (audio, video. RF modem, wideband. etc.) |
IV |
telephone circuits (duplex, incoming. supervisory signals) |
Table 4-1. Photon-Coupled Signal Line Isolator Types
4.6.5.3.1. Signal Line Isolators. Isolators can provide
more than 120 dB isolation (0 to 10 GHz) for lines passing through any equipment
or equipment area interface requiring protection. The reason for this stringent
requirement is to prevent a conductive or capacitive path for compromising
information from the RED equipment area to the BLACK equipment area and the
uncontrolled area. Take notice that one line filter cannot perform the function
of an isolator, since a conductive path is always present within the passband
of the filter. The use of filters is not recommended because ground current
loops are generated by the low impedance to ground that the filter inherently
has at frequencies above its cutoff frequency. The ground currents present
the possibility of compromise.
a. Analog. Analog photon-coupled signal line isolators
provide attenuation of the unwanted signals equal to digital isolation in
the "backward" direction. In the forward direction. they provide common mode
isolation equal to digital isolators, but do not provide transverse mode
isolation within the bandwidth of the signal being transmitted. The analog
photon-coupled signal line isolators are equal to the best active or passive
filters.
b. Photon. A photon-coupled signal line isolator allows
the input and output modules to be shielded by a ground plane connected only
by a nonconductive optical path through a waveguide penetration. A ground
plane can be a shielded room wall, conduit box, or equipment housing. This
arrangement assures a high level of signal isolation at all signal
rates.
4.6.5.3.2. Advantages of Photon-coupled Isolators. The
advantages of using photon-coupled isolators are: (1) elimination of the
electrically conductive path of undesired signals between the input and output
modules; (2) attenuation of common mode signals by use of waveguides operating
below cutoff as attenuators; (3) elimination of undesired transverse mode
signals by filtering, pulse reshaping, or pulse regeneration. The isolators
are usually mounted inside an RFI cabinet or on the wall of a shielded room.
The penetration of the shield is in the form of a waveguide tube through
which the optical path passes. The dimensions of the waveguide tube are normally
chosen to prevent the passing of RF energy below 10 GHz.
4.7. Power Distribution. The power distribution scheme
must be protected from exploitation of CE that might be developed in the
system. The scheme must conform to the life and safety provisions of the
Occupational Safety and Health Act (OSHA), the National Electrical Code (NEC),
and local building codes. MIL-HDBK-411 contains guidance for power distribution
design. The following paragraphs address the proper design of a power
distribution scheme that will satisfy RED/BLACK recommendations.
4.7.1. The Power Requirement. The power requirements
of a facility can be divided into two groups -- power for the mission equipment
(technical) and power for the supporting services (nontechnical).
Supporting services include lighting, heating, ventilating, air conditioning,
etc. By providing a separate service feeder dedicated to the sensitive equipment
and controlling its distribution, the opportunity for unauthorized detection
of compromising signals on those lines is reduced. Powerline conduction occurs
when plain text information is transferred onto the powerline by RED equipment,
or radiated through free space and coupled onto the powerlines. If a facility
is processing NSI, power is sometimes divided into RED and BLACK power. RED
power provides isolation for those non-TEMPEST approved equipment processing
NSI. BLACK power is provided for equipment processing non-NSI because power
isolation is not required. This separation prevents conducted emissions from
RED equipment being coupled through BLACK equipment to BLACK lines that might
egress the inspectable space. Adequate internal filtering permits use of
BLACK power for Level I TEMPEST compliant equipment and systems. In addition
to separate distribution facilities, the measures outlined in the subsequent
paragraphs for containment and suppression of conducted emissions apply to
RED power. RED power distribution must be designed such that neither BLACK
equipment nor utility equipment is connected to it. The design and installation
of power systems require judicious selection of the primary and auxiliary
power sources, uninterruptible power supplies (UPS) or other power conditioning
equipment, secondary substations, protective measures, and the distribution
system to attain the maximum overall system performance with the most
cost-effective design.
4.7.2. Power Conditioning/Isolation. Facilities using sensitive
solid-state equipment often include devices to condition the electrical power
by removing or suppressing harmonic distortion, surges, sags, spikes, and
electrical noise. Chiefly, powerline filters, isolation (Faraday shielded)
transformers, UPS, and power regulators are used. When the facility transformer
is located within the inspectable space and draws an average load of 100
kilovoltamperes (kVA) or more. filtering the ac power is not required.
4.7.2.1. Powerline Filters. The passive LC filter has long been used
to remove unwanted RFI from conductors of all types. Such filtering has been
in general use to prevent RFI from interfering with equipment operations.
The TEMPEST program employs filters to prevent RFI generated in equipment
from escaping as conducted CE. When applied to the treatment of powerlines,
two schools of thought exist: bulk filtering for the entire facility, and
filtering only equipment as required. Bulk filtering is expensive and generally
less effective than filtering at the equipment. Filtering at the component
and/or cabinet level is a more practical and economical approach for isolating
RED electromagnetic environments from BLACK electromagnetic environments.
Vendors' catalogs typically provide detailed information for available filters.
If the appropriate filter is not available but is required for secure equipment
operation, the following information should be provided to the filter
manufacturer for custom design of a filter:
Operating line voltage
Operating frequency
Source impedance
Load impedance
Load current
Desired bandpass frequency
Acceptable insertion loss
Powerline filters are not considered an assured method of adequately suppressing
CE. Custom designing powerline filters for each equipment is a preferred
method of preventing conducted CE from being introduced on powerlines. The
required insertion loss can be more readily attained with equipment filters
because saturation of inductors is a lesser problem due to lower current
and because impedance mismatch can be minimized due to known characteristics.
4.7.2.2. Isolation Transformers. Isolation transformers
are principally used to break ground loops to reduce common mode and differential
mode noise. An isolation transformer equipped with triple Faraday shields
is very effective in reducing conducted emission in both the power mains
and the branch feeds. The transformer can be 1: 1 ratio or stepdown. Its
installation in the facility should be as close to the load equipment as
possible, preferably in the same room, It should also be installed per NEC
Article 250-5(d) as a separately derived system and, as such, establishes
a new fault protection subsystem. It should not be tied to the green wire
serving the power main side, as this defeats the intent of both the NEC for
protection and the use of this type of transformer to break ground loops.
Further, some isolation transformers can be designed with the ground and
neutral conductors being common to the primary and secondary windings. This
reduces the isolation effectiveness of the transformer.
4.7.2.3. Uninterruptible Power Supplies and Power Regulators.
Many installations using computer or process control equipment
employ UPS and voltage regulators as a method of providing glitch free power.
Certain aspects of UPS aid in containment of conducted emissions as discussed
in the following paragraphs.
4.7.2.3.1. Solid-state UPS (SSUPS). In theory, the SSUPS
offers high isolation of conducted emissions by the nature of its operation.
SSUPS takes the incoming ac power through a dc converter or rectifier. The
filtering section of the rectifier should greatly attenuate conducted emissions.
The dc voltage is supplied to an inverter section that synthesizes a sinewave
that is filtered to reduce the probability of a conducted emission feeding
back to the power mains. For most security processing applications, an SSUPS
can be powered from either RED or BLACK power.
4.7.2.3.2. Rotating UPS. Whether
a rotating UPS is constructed as a motor generator or a no-break generator
using an inertia flywheel, its basic principles of operation provide a degree
of isolation between power mains and loads. The typical structure is an ac
synchronous motor driving a generator. Such systems offer high immunity of
the load from line disturbance. Some configurations do not provide isolation
for conducted emissions. This is particularly true if the ac motor is mounted
on a common shaft with the generator and in a common housing. If the motor
and generator shafts and housings are electrically separated and capacitively
decoupled, the emissions can be contained. Systems employing dc motors offer
some isolation regardless of the configuration. Better isolation can be achieved
if the housings are electrically and capacitively decoupled. In such systems,
conducted emissions are suppressed in the dc power supply driving the motor
and in the battery system.
4.8. Grounding System. The grounding scheme in a facility
is composed of an earth electrode subsystem, lightning protection subsystem,
fault protection subsystem, and signal reference subsystem. The signal reference
subsystem is either a single point grounding design or a multiple point
equipotential ground plane design, and it is of particular interest for control
of TEMPEST emanations. Each grounding subsystem has a separate and distinct
function as described in MIL-HDBK-419. Standards for grounding and bonding
are provided in MIL-STD-188-124. Guidance on the construction of an equipotential
grid can be found in Federal Information Processing Standards Publication
(FIPS PUB) 94 and MIL-HDBK-419, Volume II. Pertinent aspects of the single
point and equipotential grounding methods are described here to highlight
the security ramifications of each method.
4.8.1. Equipotential Plane. An equipotential ground plane
is a mass, or masses of conducting material that. when bonded together, offers
negligible impedance to current flow. In any electrical circuit, it is essential
to provide a low impedance path for signals to return from the load back
to the generator. Noise in a signal line can often be attributed to the noise
signal and current finding a lower impedance return than the intended path.
Where filters are employed in circuit design, unwanted signals are removed
from the lines and shunted to another conductor. Any signal shunted
to the ground system might circulate through multiple branches of the ground
system to return to the source. Due to uncontrolled conductor lengths and
impedance mismatches, such signals could be radiated from the conductors.
Guidance on the construction of an equipotential grid can be found FIPS PUB
94 and MIL-HDBK-419, Volume II. All equipment signal ground terminals are
bonded to the grid with leads as short as possible, but should not exceed
1/20 of the wavelength for the highest frequency of interest.
4.8.2. Single-Point Ground. Sometimes a single-point ground can be
the only viable solution for a signal grounding scheme. From the TEMPEST
viewpoint, a single point ground can satisfy the grounding requirement at
facilities where: (1) no station ground meeting the criteria of MIL-HDBK-419,
Volume II exists, (2) station ground exists, but is not accessible, and (3)
it is neither cost-effective nor practical to construct an equipotential
grounding system.
4.8.3. Fault Protection Ground. The National Electrical Code (NEC),
Article 250, requires equipping electrical power installations with a fault
protection grounding subsystem. Its purpose is to establish a common reference
and to provide an uninterrupted current path from the powered equipment back
to the first service disconnect or transformer. When a fault occurs in the
equipment, the grounding conductor will cause a circuit breaker to trip and
reduce the hazard to personnel. Use of metallic conduits and wireways as
a fault return path is not recommended for data processing and communications
equipment. The probable electrical discontinuity at conduit or wireway joints
can cause a high impedance that will generate noise. Each equipment that
is hardwired to the power source or each power outlet servicing equipment
should be connected to a dedicated, contiguous green wire protective ground
extending to the service disconnect. The protective grounding subsystem is
unacceptable as a signal reference ground for the following reasons. First,
the NEC does not intend the green wire system to carry current except during
a fault. Second, there is no control over the distribution of signals. Third,
the power distribution system is susceptible to noise that can disrupt signal
circuits.
4.8.4. Isolated Ground. Although not specifically intended for TEMPEST
treatment, an isolated ground power distribution scheme can enhance line
isolation concepts. To minimize mutual inductive coupling, the power cable
is not run in conduit. This distribution scheme consists of isolated ground
outlets, an isolated power distribution panel. and an insulated grounding
conductor. The isolated ground outlet is designed with no electrical bond
between the grounding terminal and the frame of the outlet This prevents
automatic coupling of the ground to the conduit, which would destroy the
isolated ground. The ground conductor should be connected between the grounding
terminal on the outlet and the grounding bus in the power distribution panel.
The grounding and neutral bus bars should be insulated, isolating them from
the distribution panel, conduit, and each other at this point. The grounding
conductor is then connected from the ground bus to the grounding point of
the facility main power switch gear. At this point it becomes common to the
neutral conductor and other grounding conductors used throughout the facility.
Only operational equipment should be connected to the power panel. Lights,
air handling systems, utility devices and housekeeping equipment should be
connected to a separate panel since they can induce unwanted noise into the
system. Use of an isolated ground power distribution scheme will effectively
isolate TEMPEST equipment from other electrical devices in the facility,
but is not intended to replace other required powerline isolation devices.
4.9. Administrative Support Equipment. Any facility processing NSI
will likely contain electronic administrative support systems not directly
associated with the classified processing. This can include administrative
telephones, paging systems, alarm detection systems, building utilities,
radio and television receivers. and miscellaneous unclassified computer and
communications equipment such as facsimiles, television monitors, video cassette
recorders, portable computers, modems and local area network components If
not installed according to RED/BLACK criteria. these systems can provide
a conductive path for TEMPEST emanations to escape the facility. These components
are sometimes personally owned and are often portable, which increases the
likelihood they can be incorrectly installed in a secure facility. Administrative
controls are recommended to establish local procedures to control the location
and use of administrative support equipment within a secure facility. The
use of wireless systems should be prohibited in all cases.
4.9.1. Telephone Systems. Administrative telephone systems
are a potential source for fortuitous conduction of CE due to their proximity
to building maintenance areas and their signal line distribution outside
the facility. Additional protection is recommended when commercial telephones
are located in a RED electromagnetic environment. The most effective protection
is provided by line disconnection switches and telephone line optical isolators
that use waveguide below cutoff. The use of these devices or telephone filters
must be approved by the CTTA. These devices should be considered only when
installing. replacing or retrofitting telephone systems.
4.9.1.1. TEMPEST Protective Measures. The separation
recommendations of Section 3 apply. Remember that the administrative telephone
system and its associated wiring are BLACK. The telephone system cabling
should be routed in a separate distribution system. If filters or isolators
are required and approved by the CTTA, the lines should be filtered/isolated
where they egress the inspectable space or facility. Locating the
filters/isolators at the controlled space is not recommended because the
equipment TEMPEST zone may extend beyond the controlled space. In addition,
fewer filters/,isolators will be necessary if the trunk lines rather than
the individual phone lines are filtered/isolated.
4.9.1.2. On-hook Security. Telephone systems can exhibit
insecurities even when the telephone instruments are on-hook. This happens
when RED audio or acoustic signals impinge on microphonic components in the
telephone. TSG 1 and TSG 2 provide guidance to prevent on-hook security problems.
TSG 6 lists approved and type accepted telephone equipment.
4.9.2. Paging, Intercom, and Public Address Systems. In
addition to being a possible fortuitous conductor of TEMPEST emanations,
the speakers in paging, intercom and public address systems can act as
microphones and retransmit classified audio discussions out of the controlled
area via the signal line distribution. This microphonic problem could also
allow audio from higher classified areas to be heard from speakers in lesser
classified areas. Ideally. such systems should not be used. Where deemed
vital, the following precautions should be taken in full or in part to lessen
the risk of the system becoming an escape medium for NSI.
-
Systems should be totally contained within the inspectable space.
-
Voice frequency, lowpass filters should be installed on all cables if they
are not totally contained within the inspectable space. This protects against
TEMPEST signals on the cables but does not protect against voice modulation
of the speakers.
-
Equipment should meet the separation recommendations of Section 3.
-
Amplifiers should be considered for speakers in higher classified areas to
provide reverse isolation to prevent audio from being heard in lesser classified
areas.
4.9.3. Alarm Systems. Many facilities employ alarm systems
to detect and alert personnel of life threatening or security threatening
situations. These systems employ passive or active sensors terminated on
an annunciator panel. Such systems can also act as fortuitous conductors
and could require isolation filtering and separation treatment similar to
telephone and intercom systems.
4.9.4. Miscellaneous Fortuitous Conductors. Building utilities and
other support elements can become fortuitous conductors due to the use of
metallic materials. Heating, ventilating and air conditioning systems air
ducts, water pipes and gas pipes can require protection depending on their
proximity to RED equipment and their distribution into uncontrolled areas.
If conductors are identified as likely fortuitous conductors of TEMPEST signals
into uncontrolled areas, the normal treatment is to insert a nonconductive
section in the plumbing or duct work at the boundary of the inspectable space
of the RED equipment. It is important to follow NEC, OSHA and any local building
and fire codes when isolating various conductors. Some metallic distribution
facilities must be electrically bonded to the building structure or the fault
protection subsystem. Some materials can be prohibited in utilities such
as sprinkler systems or pressurized systems. Life safety and compliance with
all applicable building codes are an overriding concern when considering
isolation of fortuitous conductors. For this reason and also due to the quantity
and variety of potential fortuitous conductors throughout a facility, isolation
of such conductors should be accomplished when practical. There are often
alternative procedures to avoid TEMPEST conduction problems with such fortuitous
conductors via relocation of equipment, or specific grounding of the fortuitous
conductor.
4.9.5. Radio Transmission or Reception Devices. Any device that transmits
or receives a radio signal is a potential security risk in a facility processing
NSI. The risk is higher for radio transmission devices and in facilities
using non-TEMPEST equipment. Traditional station designs place radio
communications (combat net radio, microwave systems, etc.) away from the
processing area. If not carefully controlled. other radio devices such as
cellular telephones, cordless telephones, wireless local area networks (LANs)
or portable satellite communications systems can be installed in a facility
near RED equipment. Radio transmission equipment should be prohibited from
all classified processing areas. If a mission requirement or space limitation
demands that transmitters must be installed in classified processing areas,
the separation recommendations of Section 3 must be met. For such installations,
a CTTA review is required to evaluate the risks of TEMPEST vulnerabilities.
Reception devices such as radios, television receivers, receive-only beepers
can be installed if authorized by cognizant security authorities and if installed
in compliance with the separation recommendations of Section 3.
4.9.6. Commercial Television System Installation. When commercial
television systems are installed in secure areas, the CTTA should determine
the countermeasures to prevent a video cable entering the secure area from
conducting compromising emanations out of the secure area. The countermeasures
depend on the type of cable used to bring the signal into the secure area.
If an optical fiber cable is used at the entry point to the secure area,
no additional countermeasure is required. If a metallic cable is used at
the entry point, an amplifier/attenuator system may be required that should
be located at the point where the cable enters the secure area. The type
of amplifier/attenuator system used depends on the number of television receivers
that will receive the video signal. For up to two television receivers, a
video cassette recorder (VCR) can provide the video service and will also
act as a "one way" filter. If a control box is used, it should be collocated
with the VCR. The VCR should not be used for processing classified information
unless the incoming video cable is disconnected. For more than two television
receivers, an amplifier/attenuator system could be required to provide adequate
signal level to the television receivers and to provide additional reverse
isolation. An attenuator could be required if the amplified signal overdrives
the television receivers. The attenuator will also provide additional reverse
attenuation. Amplifiers that can amplify signals in both directions should
not be used. Commercial television system equipment and cables should comply
with the separation guidance in Section 3.
4.10. Other Considerations
4.10.1 TEMPEST Zoning. TEMPEST zoning is a countermeasure that takes
advantage of free space propagation loss and the inherent shielding of a
host facility. By profiling a structure's attenuation, TEMPEST zoning can
allow equipment operation with less fear of unauthorized intercept and without
the added expense of TEMPEST approved equipment or global shielding. The
concept profiles the facility into zones that have varying levels of protection.
This is determined by developing attenuation plots of radiated signals in
four test bands between 10 MHz and 1,000 MHz compared with reference measurements
taken with antennas separated by 20 meters in an open field environment.
The TEMPEST zone profile data for a facility can then be used in conjunction
with known TEMPEST zone characteristics of electronic equipment to enable
selection and placement of equipment to contain radiated TEMPEST emanations
within the predetermined secure areas of the facility. NSTISSAM TEMPEST/2-92
contains details for TEMPEST zoning of facilities.
4.10.2. Inspectable Space. The inspectable space can vary considerably
from one facility location to another. It is important to understand the
boundaries of the inspectable space surrounding a facility to properly apply
RED/BLACK countermeasures. The site designated TEMPEST approval authorities
should define and a CTTA should approve the boundary.
4.10.3. Facility Shielding. In certain instances, systems processing
NSI are so large and complex that application of TEMPEST protective measures
to the equipment can be impossible or exorbitantly expensive. In such cases.
the entire facility can be shielded and power, signal and utility penetrations
of the shield treated to block and remove conducted CE. This approach should
be implemented only after a thorough cost comparison analysis of alternative
security countermeasures. Obtain guidance from a CTTA to determine requirements
and recommended methods for shielding. NSTISSAM TEMPEST/1-94
contains details on shielding.
4.10.4. TEMPEST Suppressed Equipment. TEMPEST equipment have been
tested in accordance with NSTISSAM TEMPEST/1-92 and demonstrated to comply
with conducted and electromagnetic radiation limits of Level I, Level II
or Level III.
SECURE VOICE SYSTEMS
5.1. General. A secure voice installation is unique in
that the terminals are used both in highly controlled areas and also in minimally
controlled areas, or residential type areas.
5.2. Basis for Minimum Installation Techniques. The very
nature of the system dictates the flexibility, ease of installation,
removal, and reinstallation. Protection of the system is generally afforded
via low-level signaling and use of TEMPEST approved equipment or an inspectable
space. TEMPEST hazards such as crosstalk are problems that must be considered
and their effects minimized. Secure voice systems should be isolated and
source suppression fixes should be designed and incorporated by competent
engineering and security authorities. System radiation and conduction levels
that are in accordance with NSTISSAM TEMPEST/1-92 cannot be achieved through
routine installation standards. Engineering fixes, when prudently applied
with low-level techniques, do provide requisite protection.
5.3. Installation Guidance.
5.3.1. General. Select the countermeasure that contains
the basic considerations for planning a secure voice installation. Where
a conflict arises between that guidance and this appendix, the guidance contained
herein apply.
5.3.2. Multiple Terminal Installations. When two or more
secure voice terminals are installed in the same location, any one of which
is capable of operating in a plain or cipher mode, the RED signal leads of
each terminal should be installed using separate nonferrous shielded twisted
pairs in the same cable or should be installed in separate shielded cables.
Additional measures could be required when RED digitized text is
transmitted.
5.3.3. Location. Console and automatic switches that could handle
RED lines should be located in a secure area.
5.3.4. High-risk Areas. When secure voice terminals are
installed in a high-risk area, residence or UAA, the following should be
accomplished:
-
Cable routing should be such that the cable run is not evident and meets
the security requirements while blending with the decor and construction
of the residence.
-
All components of the system should be installed to prevent casual viewing.
-
RED cable runs to remote instruments within the residence should be separated
from all other distributions in the residence and should be metallically
enclosed.
5.4. Security Guidance
5.4.1. Terminals with Multiple Handsets. Visually monitor
the on-hook or off-hook condition of the other handsets when using terminals
with multiple handsets. This requirement is satisfied if all handsets can
be viewed from any handset location.
5.4.2. Location of Equipment. The equipment of a secure
voice terminal should be located together, and not within the view of uncleared
personnel.
5.4.3. High-risk Areas. Due to limitation of physical
safeguards and threat of technical surveillance, special considerations are
required for these areas.
5.5. STU-III Guidance. The Secure Telephone Unit, Third
Generation (STU-III), is a self-contained TEMPEST certified secure telephone
device. It can be operated as a voice terminal, or can be connected to a
data or facsimile device. When used for secure voice communications only,
no additional TEMPEST treatment is required. When a STU-III connects to a
RED processor, use a shielded cable with the shield bonded to the connector
shell at both ends. If the RED processor is installed in the same general
area as the STU-III, meets the separation recommendations of Section 3, and
is afforded adequate physical security, no additional treatment is required.
If the RED processor is installed in another room and the interconnect cable
penetrates a barrier (e.g.. a wall), the cable should be encapsulated in
rigid conduit or cable duct. The STU-III can also be used as a trunking device
to provide an interface with a RED switch. Installation should be in accordance
with recommendations specified in this document.
NOTE: External signal line and power line filters can cause the STU-III
terminals to malfunction.
SENSITIVE COMPARTMENTED INFORMATION
6.1. General. This appendix sets forth criteria to permit
RED sensitive compartmented information (SCI) and RED non-SCI to be
processed through components of a single RED distribution system. Where the
sharing of a single system is feasible, considerable cost savings can be
realized. In some cases, the savings will permit wider application of secure
voice and other services that otherwise could not be achieved if separate
systems were required. In order to preclude unintentional compromise of SCI
in shared systems, the constraints contained in this appendix take precedence
over other recommendations. For most cases, the measures prescribed are
sufficient to prevent unintentional misrouting of SCI into non-SCI channels
and to limit SCI crosstalk into non-SCI circuits to levels that are
nondiscernible except by a deliberate instrumented attack. An instrumented
attack to exploit SCI crosstalk or other SCI radiated or conducted emanations
present in U.S. controlled, non-SCI areas is viewed as unlikely, because
only U.S. cleared individuals would have the access to mount such an attack.
In most cases, the risk is considered acceptable, but where the cognizant
SCI approval authority (Director of Central Intelligence Agency, Director
of the National Security Agency, or Director of the Defense Intelligence
Agency, as appropriate) deems necessary, additional requirements for safeguarding
of SCI may be imposed with CTTA validation of the additional countermeasures.
In some cases, the requirements of this appendix may be too restrictive and
may be waived by the above authorities to allow both SCI and non-SCI under
their cognizance to be processed over a single RED system.
NOTE: The Director of Central Intelligence provides guidance on physical
security for SCI facilities in DCID 1/21.
6.2. Routing of SCI Cables. All SCI cables should be
contained totally within the SCI areas unless installed in a protected
distribution system (PDS) approved by the cognizant CTTA.
6.3. Termination Boxes. Separate dedicated termination
boxes must be used for SCI circuits. These boxes are for convenience in
interfacing the SCI signal cable to the terminal equipment and should be
located close to the equipment. SCI termination boxes must be within SCI
areas.
6.4. Distribution Frame. Separate dedicated distribution
frames (any cabinet or box containing terminal blocks for cable cross connects
or interconnects) must be used for SCI circuits. A common SCI/non-SCI enclosure
(cabinet, box. etc.) may be used, but a rigid partition must physically separate
the SCI and non-SCI areas to preclude inadvertent cross connects or interconnects
of SCI to non-SCI circuits. The SCI area must be conspicuously labeled
"Sensitive Compartmented Information (SCI)." No matter that enclosure
is selected. shields of SCI and non-SCI cables must not be tied back or
disconnected upon entering a frame, but must continue into their respective
areas to reduce the possibility of crosstalk between unshielded conductors.
Similarly, SCI and non-SCI cross connects and interconnects must never be
grouped together. If two enclosures are used, each with SCI and non-SCI areas,
SCI cross connects and interconnects between the enclosures must be via separate
conduit or separate overall shield so that separation and isolation from
non-SCI circuits is maintained.
6.5. Patch Panels. Separate dedicated patch panels must
be used for unencrypted SCI circuits and encrypted SCI circuits. SCI patch
panels should be uniquely wired, using different styled jacks and plugs,
or be sufficiently separated from other patch panels to preclude inadvertently
cross patching SCI circuits to non-SCI (encrypted) circuits. SCI patch panels
must be within SCI areas, or under combination lock if
outside SCI areas, with lock combination available only to SCI-cleared
personnel.
6.6. Multiplexers, Video and Audio Switches, and Other Multiple Circuit
Equipment. Multiplexers, video switches, audio switches and other multiple
circuit equipments associated with RED unencrypted signal lines may be used
to process both SCI and non-SCI, subject to the following
conditions:
a. Plain Text Transmission. The probability of inadvertent
plain text transmission of SCI to a non-SCI user due to channel slippage
or other causes shall be no greater than one per million.
b. Unwanted Third Party Connection. The probability of
an unwanted third party connection to an SCI circuit shall be no greater
than one per million.
c. Crosstalk. Crosstalk levels between any channels within
an equipment, to include those likely to yield worst case conditions (e.g.,
adjacent conductors or paths in the same cable, on the same printed circuit
board, through the same integrated circuit component, etc.), shall meet the
applicable standards below:
-
65 dB minimum audio crosstalk isolation at any frequency between 0.3 and
15 kHz.
-
60 dB minimum video crosstalk isolation at any frequency up to 5 MHz with
nonsynchronous sources.
-
30 dB minimum baseband digital crosstalk isolation. Baseband is defined as
the frequency range from the digital rate (Rd)
to 10Rd.
6.7. Access Points. Access to all points with breakouts
of the SCI circuits must be restricted to SCI-cleared personnel. Access points
containing SCI and non-SCI circuits that do not have breakouts of the SCI
circuits can be serviced by non-SCI personnel, if escorted by appropriately
cleared SCI personnel. These requirements apply both within SCI areas and
for protected signal distribution systems external to SCI areas.
6.8. Cables. Separate dedicated cables must be used for
SCI circuits, e.g., all conductors within the overall sheath of a cable carrying
SCI can be used only for SCI circuits. All metallic cables installed in the
signal distribution system must have, as a minimum, one overall nonferrous
shield, with the exception that applications requiring coaxial cable must
use a cable having a separate insulated shield, e.g., twinaxial or triaxial
(preferably twinaxial for data rates up to 1 MHz and triaxial for data rates
above 1 MHz). Section 3 and Section 4, paragraph 4.4. provide additional
signal line guidance including use of optical fiber cables.
6.9. Low-level Signaling. A design objective of the signal
distribution system is that all digital signals comply with the low-level
criteria in MIL-STD-188-114. Exceptions must be evaluated and approved on
a case-by-case basis by the appropriate accrediting CTTA.
6.10. Power and Signal Line Filtering. The accrediting
CTTA should determine the requirement for power and signal line
filtering.
6.11. Standard Service Features. Generally, SCI systems
should use the standard service features of the overall facility used for
secure non-SCI systems such as power, ground systems, etc.
6.12. Telephone Lines. The accrediting authority should
determine, on a case-by-case basis, the need for filtering or optical isolation
at the point of entry all telephone lines entering an SCI facility containing
equipment (TEMPEST approved or not approved) that process SCI data. If the
telephone lines have been filtered or optically isolated at the boundary
of a lesser classified area prior to entry to the SCI facility, the requirement
for additional filters or isolators at the SCI facility boundary should be
evaluated by appropriate accrediting CTTA.
6.13. RED/BLACK Separation. The RED/BLACK separation
recommendations in Section 3 apply for systems processing SCI data.
6.14. Additional Requirements. Contact the cognizant
SCI approval CTTA to ascertain whether additional RED/BLACK and TEMPEST measures
are required for facilities processing SCI.
THIS PAGE IS INTENTIONALLY LEFT BLANK
TRANSPORTABLE SYSTEMS IN A TACTICAL ENVIRONMENT
7.1. General. The primary TEMPEST vulnerability of
transportable systems operated in a tactical environment is NONSTOP. This
appendix provides guidance to protect against this vulnerability.
7.2. Modes of Operation. Transportable systems can be
operated in various modes including;
-
fixed or docked to a permanent facility for sixty or more days,
-
field deployed to one location less than sixty days,
-
vehicular mounted and operated on the move or stopped for less than one day.
Transportable systems can be operated singly or in groups. Groups can be
operated with interconnecting cables.
7.2.1 Fixed Operation. Transportable systems operated
at a fixed location for sixty or more days shall be installed according to
Recommendation I of Table 3- 1. In addition, the following recommendations
apply.
7.2.1.1. RED Cables. RED wire cables shall be shielded
and insulated overall.
7.2.1.2. Separation. RED processors should be separated
by one meter from any BLACK equipment with wire lines that exit the inspectable
space or are connected to an RF transmitter. If the separation cannot be
maintained, the CTTA must conduct a review to determine whether filters or
other countermeasures should be recommended. For existing facilities the
CTTA could request TEMPEST/NONSTOP tests be performed to determine needed
countermeasures.
7.2.1.3. CTTA Review. Vulnerabilities introduced by operating
in a tactical environment could affect the requirements for inspectable space
definition, power source restrictions and grounding procedures and should
be reviewed by the CTTA. The CTTA could request TEMPEST/NONSTOP be performed
to determine needed countermeasures.
7.2.2. Field Deployed. Transportable systems deployed
in the field for less than sixty days should meet the recommendations in
paragraphs 7.2.1.1. and 7.2.1.2.
7.2.3. Vehicular Mounted. If the vehicular mounted systems
do not use commercial power and have no conductors egressing the inspectable
space, only the following recommendations apply. A CTTA should review all
other vehicular mounted systems to determine if additional countermeasures
apply.
-
RED processors should not be powered from the same circuit breaker panel
as RF transmitters.
-
RED wires shall be shielded and insulated overall.
-
RED wire lines shall be separated by five centimeters from BLACK wire lines
and BLACK power lines connected to an RF transmitter.
-
RED processors should be separated to the maximum extent possible but not
less than five centimeters from BLACK wire lines and BLACK equipment
Note: The CTTA could request TEMPEST/NONSTOP tests be performed to determine
the TEMPEST security of the installation.
7.3. Deploying Equipment Away from Transportables. When
deploying equipment to tents or buildings, any shielding provided
by the transportable is lost. Field expedient installations may create TEMPEST
vulnerabilities. Buildings could have many fortuitous conductors (visible
or hidden) that can conduct signals beyond the inspectable space. If such
an installation is to be in place for sixty or more days, the CTTA should
determine whether any fixed facility installation procedures should be
applied.
7.4. Physical Security. The management of inspectable
space and the control of conductors leaving the inspectable space must be
incorporated in the tactical physical security plan.
AIRCRAFT
8.1. General. The primary TEMPEST vulnerability of aircraft
systems (fixed wing, rotary wing, remote pilotless vehicle) is NONSTOP. This
appendix provides guidance to protect against this vulnerability.
8.2. Aircraft Installations. Aircraft installation
vulnerabilities can be associated in two categories: airborne operations
and ramp operations. The applications of TEMPEST design and countermeasures
must consider weight, size, power consumption, cooling
requirements and available space.
8.2.1. Airborne Operations. Aircraft systems will be
installed according to Recommendation I of Table 3-1. In addition, the following
recommendations apply.
8.2.1.1. RED Cables. RED wire cables shall be shielded
and insulated overall.
8.2.1.2. Separation. RED processors shall be separated
by one meter from any BLACK equipment with wire lines that exit the inspectable
space or are connected to an RF transmitter. If the separation cannot be
maintained, the CTTA must conduct a review to determine whether filters or
other countermeasures should be recommended. For existing facilities the
CTTA could request TEMPEST/NONSTOP tests be performed to determine needed
countermeasures.
8.2.1.3. Grounding. Grounding onboard an aircraft is
critical. While it may appear that the skin and structure of the aircraft
provides an equipotential plane, empirical data shows that many current paths
exist because of seams, material used and static buildup during flight. In
addition, the aircraft structure provides power return, protective ground
and signal grounds. These conditions must be considered when designing the
grounding scheme. The following guidance supersedes Section 4.
-
Protective ground systems should be installed according to MIL-HDBK-419.
-
There should be separate RED and BLACK ground systems. All ground
systems should be separated from each other according to the recommendations
in Section 3 and connected directly to the aircraft structure. A signal ground
should be established at each component level requiring such a return path.
-
Internal cable shields should be grounded by the most direct
routing to the aircraft structure at one end only as close to the RED source
as practical.
-
Cable overall shields should be grounded at both ends and at
intermediate points as practical.
8.2.2. Ramp Operations. All of the guidance for airborne
operations apply for ramp operations. Vulnerabilities introduced by operating
in this environment could affect the requirements for inspectable space
definition, power source restrictions and grounding procedures and should
be reviewed by the CTTA. The CTTA could request TEMPEST/NONSTOP be performed
to determine needed countermeasures.
8.2.3. Physical Security. The management of inspectable
space and the control of conductors leaving the inspectable space must be
incorporated in the ramp operations physical security plan.
THIS PAGE IS INTENTIONALLY LEFT BLANK
SHIPS
9.1. General. The primary TEMPEST vulnerability of ships is NONSTOP.
This appendix provides guidance to protect against this vulnerability.
9.2. Shipboard Installations. Shipboard installation vulnerabilities
can be associated in two categories: underway (at sea) and in port.
9.2.1. Underway Operations. Shipboard systems will be
installed according to Recommendation I of Table 3- . In addition, the following
recommendations apply.
9.2.1.1. RED Cables. RED wire cables shall be shielded and insulated
overall.
9.2.1.2. Separation. RED processors shall be separated by one meter
from any BLACK equipment with wire lines that exit the inspectable space
or are connected to an RF transmitter. If the separation cannot be maintained,
the CTTA must conduct a review to determine whether filters or other
countermeasures should be recommended. For existing facilities, the CTTA
could request TEMPEST/NONSTOP tests be performed to determine needed
countermeasures.
9.2.1.3. Shielded Cables. Shielded cables must meet the applicable
requirements of MIL-C- 17, MIL-C-915. MIL-C-24640, or MIL-C-24643.
9.2.1.4. RED Ground. RED equipment must be bonded to ground according
to MIL-STD-1310.
9.2.1.5. Cryptographic Equipment Ground. Cryptographic equipment must
be bonded according to installation control drawings. In the absence of
installation control drawings, bond according to MIL-STD-1310.
9.2.1.6. Cable Distribution. Cables may contain conductors connected
to both a RED distribution system and a BLACK distribution system provided
the RED conductors are either shielded individually or overall and separately
from the BLACK conductors. This guidance supersedes Recommendation I, paragraph
2, Note 2 of Section 3.
9.2.2. In Port Operations. All shipboard systems shall be designed
to comply with the requirements for underway operations as approved by the
CTTA. Vulnerabilities introduced by operating in this environment could affect
the requirements for inspectable space definition, power source restrictions,
land line connections, etc., and should be reviewed by the CTTA. The CTTA
could request TEMPEST/NONSTOP be performed to determine needed countermeasures.
9.2.3. Physical Security. The management of inspectable space and
the control of conductors leaving the inspectable space must be incorporated
in the port physical security plan.
THIS PAGE IS INTENTIONALLY LEFT BLANK
COMMENT FORM for NSTISSAM TEMPEST/2-95
Use one form per comment.
Return completed form to:
Attn: C3
Department of Defense
National Security Agency
Fort George G. Meade, Maryland 20755-6000
1. Date:
2. Name of Contributor:
3. Name of Organization:
4. Address of Organization:
5. Reference section in document (page number, paragraph. line number if
required: if general comment, describe subject to be discussed):
6. Comment (What should be changed?):
7. Alternative (What should it be changed to?):
8. Rationale (Why should change be made?):
If more space is required for any of the above items, use extra sheet(s)
and attach to this form.
THIS PAGE IS INTENTIONALLY LEFT BLANK
Transcription and HTML by Cryptome.
|
