{"stig":{"title":"AAA Services Security Requirements Guide","version":"2","release":"2"},"checks":[{"vulnId":"V-204636","ruleId":"SV-204636r1043176_rule","severity":"medium","ruleTitle":"AAA Services must be configured to provide automated account management functions.","description":"Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. A comprehensive account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to disable inactive accounts after a specified time period, or to lock accounts after a specified number of unsuccessful attempts at logon.\n\nAAA Services must be configured to automatically provide account management functions, and these functions must immediately enforce the organization's current account policy. The automated mechanisms may reside within AAA Services or may be directory services providing automated account management externally. Automated mechanisms may be composed of differing technologies that when placed together contain an overall automated mechanism supporting an organization's automated account management requirements. \n\nAccount management functions include assignment of role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example, using email or text messaging to automatically notifying account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephonic notification to report atypical system account usage.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are configured to provide automated account management functions. Automated functions include disabling accounts after specified periods of inactivity, locking accounts after a specified number of incorrect logon attempts, etc. Where possible, automated functions must be performed on users and devices globally rather than by each individual account.\n\nIf AAA Services do not provide automated account management functions, this is a finding.","fixText":"Configure AAA Services to provide automated account management functions. Automated functions include disabling accounts after specified periods of inactivity, locking accounts after a specified number of incorrect logon attempts, etc. Where possible, automated functions must be performed on users and devices globally rather than by each individual account.","ccis":["CCI-000015"]},{"vulnId":"V-204637","ruleId":"SV-204637r960771_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically remove temporary user accounts after 72 hours.","description":"When temporary user accounts remain active after no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary user accounts must be set upon account creation. Disabling a temporary account provides a higher risk alternative; disabling allows an insider adversary to enable the privileged account and make it permanent.\n\nTemporary accounts, when used, mandate that AAA Services must be configured to automatically terminate these types of accounts after 72 hours. When AAA Services do not perform account management, the connected Active Directory must provide this setting.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically remove temporary user accounts after 72 hours.\n\nIf the AAA Services configuration does not automatically remove temporary user accounts after 72 hours, this is a finding.","fixText":"Configure AAA Services to automatically remove temporary user accounts after 72 hours.","ccis":["CCI-000016"]},{"vulnId":"V-204638","ruleId":"SV-204638r960771_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically remove authorizations for temporary user accounts after 72 hours.","description":"When temporary user accounts remain active after no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary user accounts must be set upon account creation. Disabling a temporary account provides a higher risk alternative; disabling allows an insider adversary to enable the privileged account and make it permanent.\n\nTemporary accounts, when used, mandate that AAA Services must be configured to automatically terminate these types of accounts after 72 hours. When AAA Services do not perform account management, the connected Active Directory must provide this setting.","checkContent":"If AAA Services do not provide authorizations based on external directory services, this is not applicable.\n\nVerify AAA Services are configured to automatically remove authorizations for temporary user accounts after 72 hours.\n\nIf the AAA Services configuration does not automatically remove authorizations for temporary user accounts after 72 hours, this is a finding.","fixText":"Configure AAA Services to automatically remove authorizations for temporary user accounts after 72 hours.","ccis":["CCI-000016"]},{"vulnId":"V-204639","ruleId":"SV-204639r960774_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically disable accounts after a 35-day period of account inactivity.","description":"Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications need to track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise. \n\nThis policy does not apply to either emergency accounts or an infrequently used account (e.g., account of last resort). Infrequently used accounts are local logon administrator accounts used by system administrators when network or normal logon/access is not available. Emergency accounts are administrator accounts created in response to crisis situations.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically disable accounts after a 35-day period of account inactivity.\n\nIf the AAA Services configuration does not automatically disable accounts after a 35-day period of account inactivity, this is a finding.","fixText":"Configure AAA Services to automatically disable accounts after a 35-day period of account inactivity.","ccis":["CCI-000017"]},{"vulnId":"V-204640","ruleId":"SV-204640r960777_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically audit account creation.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply create a new account. Auditing of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the creation of user accounts and, as required, notifies administrators and/or managers. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically audit account creation.\n\nIf AAA Services are not configured to automatically audit account creation, this is a finding.","fixText":"Configure AAA Services to automatically audit account creation.","ccis":["CCI-000018"]},{"vulnId":"V-204641","ruleId":"SV-204641r960780_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically audit account modification.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply modify an existing account. Auditing of account modification is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the modification of user accounts and, as required, notifies administrators and/or managers. Such a process greatly reduces the risk that accounts will be surreptitiously modified and provides logging that can be used for forensic purposes.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically audit account modification.\n\nIf AAA Services are not configured to automatically audit account modification, this is a finding.","fixText":"Configure AAA Services to automatically audit account modification.","ccis":["CCI-001403"]},{"vulnId":"V-204642","ruleId":"SV-204642r960783_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically audit account disabling actions.","description":"When application accounts are disabled, user accessibility is affected. Once an attacker establishes access to an application, the attacker often attempts to disable authorized accounts to disrupt services or prevent the implementation of countermeasures. Auditing account disabling actions provides logging that can be used for forensic purposes.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically audit account disabling actions.\n\nIf AAA Services are not configured to automatically audit account disabling actions, this is a finding.","fixText":"Configure AAA Services to automatically audit account disabling actions.","ccis":["CCI-001404"]},{"vulnId":"V-204643","ruleId":"SV-204643r960786_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically audit account removal actions.","description":"When application accounts are removed, user accessibility is affected. Once an attacker establishes access to an application, the attacker often attempts to remove authorized accounts to disrupt services or prevent the implementation of countermeasures. Auditing account removal actions provides logging that can be used for forensic purposes.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically audit account removal actions.\n\nIf AAA Services are not configured to automatically audit account removal actions, this is a finding.","fixText":"Configure AAA Services to automatically audit account removal actions.","ccis":["CCI-001405"]},{"vulnId":"V-204644","ruleId":"SV-204644r960840_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.","description":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.\n\nIf AAA Services are not configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period, this is a finding.","fixText":"Configure AAA Services to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.","ccis":["CCI-000044"]},{"vulnId":"V-204645","ruleId":"SV-204645r960879_rule","severity":"medium","ruleTitle":"AAA Services must be configured to audit each authentication and authorization transaction.","description":"Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. \n\nAudit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.\n\nDoD has defined the list of events for which the application will provide an audit record generation capability as the following: \n\n(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);\n(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and\n(iii) All account creation, modification, disabling, and termination actions.","checkContent":"Verify AAA Services are configured to audit each authentication and authorization transaction.\n\nIf AAA Services are not configured to audit each authentication and authorization transaction, this is a finding.","fixText":"Configure AAA Services to audit each authentication and authorization transaction.","ccis":["CCI-000169"]},{"vulnId":"V-204646","ruleId":"SV-204646r960891_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify what type of events occurred.","description":"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. \n\nAudit record content that may be necessary to satisfy the requirement of this policy includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\n\nAssociating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.","checkContent":"Verify AAA Services configuration audit records identify what type of events occurred.\n\nIf AAA Services configuration audit records do not identify what type of events occurred, this is a finding.","fixText":"Configure AAA Services audit records to identify what type of events occurred.","ccis":["CCI-000130"]},{"vulnId":"V-204647","ruleId":"SV-204647r960894_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify when (date and time) the events occurred.","description":"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident.\n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know when events occurred (date and time). \n\nAssociating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.","checkContent":"Verify AAA Services configuration audit records identify the date and time events occurred.\n\nIf AAA Services configuration audit records do not identify when the events occurred, this is a finding.","fixText":"Configure AAA Services audit records to identify when the events occurred by specifying the date and time.","ccis":["CCI-000131"]},{"vulnId":"V-204648","ruleId":"SV-204648r960897_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify where the events occurred.","description":"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident.\n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as application components, modules, session identifiers, filenames, host names, and functionality. \n\nAssociating information about where the event occurred within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.","checkContent":"Verify AAA Services configuration audit records identify where the events occurred.\n\nIf AAA Services configuration audit records do not identify where the events occurred, this is a finding.","fixText":"Configure AAA Services audit records to identify where the events occurred.","ccis":["CCI-000132"]},{"vulnId":"V-204649","ruleId":"SV-204649r960900_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify the source of the events.","description":"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\n\nIn addition to logging where events occur within the application, the application must also produce audit records that identify the application itself as the source of the event.\n\nIn the case of centralized logging, the source would be the application name accompanied by the host or client name. \n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know the source of the event, particularly in the case of centralized logging.\n\nAssociating information about the source of the event within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.","checkContent":"Verify AAA Services configuration audit records identify the source of the events.\n\nIf AAA Services configuration audit records do not identify the source of the events, this is a finding.","fixText":"Configure AAA Services configuration audit records to identify the source of the events.","ccis":["CCI-000133"]},{"vulnId":"V-204650","ruleId":"SV-204650r960903_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify the outcome of the events.","description":"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the system.\n\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.","checkContent":"Verify AAA Services configuration audit records identify the outcome of the events.\n\nIf AAA Services configuration audit records do not identify the outcome of the events, this is a finding.","fixText":"Configure AAA Services configuration audit records to identify the outcome of the events.","ccis":["CCI-000134"]},{"vulnId":"V-204651","ruleId":"SV-204651r960906_rule","severity":"medium","ruleTitle":"AAA Services configuration audit records must identify any individual user or process associated with the event.","description":"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\n\nEvent identifiers (if authenticated or otherwise known) include, but are not limited to, user database tables, primary key values, user names, or process identifiers.","checkContent":"Verify AAA Services configuration audit records identify any individual user associated with the event. When a system process rather than an individual user causes the event, the process must be identified in the audit record.\n\nIf AAA Services configuration audit records do not identify any individual user or process associated with the event, this is a finding.","fixText":"Configure AAA Services configuration audit records to identify any individual user associated with the event. When events are caused by a system process rather than an individual user, that process must be identified in the audit record.","ccis":["CCI-001487"]},{"vulnId":"V-204652","ruleId":"SV-204652r960912_rule","severity":"medium","ruleTitle":"AAA Services must be configured to alert the SA and ISSO when any audit processing failure occurs.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. \n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.","checkContent":"Verify AAA Services are configured to alert the SA and ISSO when any audit processing failure occurs.\n\nIf AAA Services are not configured to alert the SA and ISSO when any audit processing failure occurs, this is a finding.","fixText":"Configure AAA Services to alert the SA and ISSO when any audit processing failure occurs.","ccis":["CCI-000139"]},{"vulnId":"V-204655","ruleId":"SV-204655r960927_rule","severity":"medium","ruleTitle":"AAA Services must be configured to use internal system clocks to generate time stamps for audit records.","description":"Without an internal clock used as the reference for the time stored on each event to provide a trusted common reference for the time, forensic analysis would be impeded. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. \n\nIf the internal clock is not used, the system may not be able to provide time stamps for log messages. Additionally, externally generated time stamps may not be accurate. Applications can use the capability of an operating system or purpose-built module for this purpose. Synchronizing the internal clock using NTP provides uniformity for all system clocks over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.","checkContent":"Verify AAA Services are configured to use internal system clocks to generate time stamps for audit records.\n\nIf AAA Services are not configured to use internal system clocks to generate time stamps for audit records, this is a finding.","fixText":"Configure AAA Services to use internal system clocks to generate time stamps for audit records.","ccis":["CCI-000159"]},{"vulnId":"V-204656","ruleId":"SV-204656r960963_rule","severity":"medium","ruleTitle":"AAA Services must be configured to disable non-essential modules.","description":"It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). \n\nExamples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.","checkContent":"Determine if AAA Services are configured to disable non-essential modules.\n\nIf AAA Services are not configured to disable non-essential modules, this is a finding.","fixText":"Configure AAA Services to disable non-essential modules.","ccis":["CCI-000381"]},{"vulnId":"V-204657","ruleId":"SV-204657r1043177_rule","severity":"high","ruleTitle":"AAA Services must be configured to use secure protocols when connecting to directory services.","description":"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\n\nApplication communication sessions are protected utilizing transport encryption protocols, such as TLS. TLS provides a means to authenticate sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. \n\nThis requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.","checkContent":"If AAA Services do not connect to a directory services or other identity provider, but instead perform user and device account management as part of their functionality, this is not applicable.\n\nReview the AAA Services configuration when connecting to directory services or another identity provider. Verify the connection is configured to use secure protocols for transport between AAA Services and the directory services using mutual authentication. The use of LDAP over TLS (LDAPS) is the most common method to secure the directory services or user database traffic. Each protocol egressing the local enclave must be implemented in accordance with its PPSM CAL.\n\nIf AAA Services do not use secure protocols when connecting to directory services, this is a finding. If the protocols are not implemented in accordance with the PPSM CAL, this is a finding.","fixText":"Configure AAA Services to use secure protocols when connecting to directory services. The use of LDAP over TLS (LDAPS) is the most common method to secure the directory services or user database traffic. However, proprietary or other protocols may be used in some configurations. Each protocol egressing the local enclave must be implemented in accordance with its PPSM CAL.","ccis":["CCI-000382"]},{"vulnId":"V-204658","ruleId":"SV-204658r1043177_rule","severity":"high","ruleTitle":"AAA Services must be configured to use protocols that encrypt credentials when authenticating clients, as defined in the PPSM CAL and vulnerability assessments.","description":"Authentication protection of the client credentials (specifically the password or shared secret) prevents unauthorized access to resources. The RADIUS protocol encrypts the password field in the access-request packet, from the client to the AAA server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third-party. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. Other protocols have similar protections. When unencrypted credentials are passed, adversaries can gain access to resources.","checkContent":"Verify AAA Services are configured to use protocols that encrypt credentials when authenticating clients. Both the RADIUS and TACACS+ protocols are acceptable when configured to perform encryption. For any protocol implemented, the PPSM CAL and vulnerability assessments must be reviewed to ensure the protocols are properly configured.\n\nIf AAA Services are not configured to use protocols that encrypt credentials when authenticating clients, as defined in the PPSM CAL and vulnerability assessments, this is a finding.","fixText":"Configure AAA Services to use protocols that encrypt credentials when authenticating clients. Both the RADIUS and TACACS+ protocols are acceptable when configured to perform encryption. For any protocol implemented, the PPSM CAL and vulnerability assessments must be reviewed to ensure the protocols are properly configured.","ccis":["CCI-000382"]},{"vulnId":"V-204659","ruleId":"SV-204659r1043177_rule","severity":"medium","ruleTitle":"AAA Services must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services; however, doing so increases risk over limiting the services provided by any one component. \n\nTo support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.","checkContent":"Review the AAA Services configuration to ascertain if it prohibits or restricts the use of organization-defined functions, ports, protocols, and/or services. Further determine if the use is as defined in the PPSM CAL and vulnerability assessments.\n\nIf AAA Services are not configured in accordance with the PPSM CAL and vulnerability assessments, this is a finding.","fixText":"Configure AAA Services to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.","ccis":["CCI-000382"]},{"vulnId":"V-204660","ruleId":"SV-204660r1051115_rule","severity":"high","ruleTitle":"AAA Services must be configured to uniquely identify and authenticate organizational users.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. \n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following.\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and \n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"Verify AAA Services are configured to uniquely identify and authenticate organizational users. For STIGs produced from this requirement, when AAA Services are used to authenticate processes acting on behalf of organizational users, they also must be uniquely identified and authenticated.\n\nIf AAA Services are not configured to uniquely identify and authenticate organizational users, this is a finding.","fixText":"Configure AAA Services to uniquely identify and authenticate organizational users.","ccis":["CCI-000764"]},{"vulnId":"V-204661","ruleId":"SV-204661r960972_rule","severity":"medium","ruleTitle":"AAA Services must be configured to require multifactor authentication using Personal Identity Verification (PIV) credentials for authenticating privileged user accounts.","description":"Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. \n\nMultifactor authentication requires using two or more factors to achieve authentication. \n\nFactors include: \n(i) something a user knows (e.g., password/PIN); \n(ii) something a user has (e.g., cryptographic identification device, token); or \n(iii) something a user is (e.g., biometric). \n\nA privileged account is defined as an information system account with authorizations of a privileged user. \n\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).","checkContent":"Verify AAA Services are configured to require multifactor authentication using PIV credentials for authenticating privileged user accounts. Although the Common Access Card (CAC) is a PIV credential, it should not be used for privileged accounts, but rather only for non-privileged accounts. Administrative smart cards and tokens, separate from the CAC, are the preferred solution for privileged accounts.\n\nIf AAA Services are not configured to require multifactor authentication using PIV credentials for authenticating privileged user accounts, this is a finding.","fixText":"Configure AAA Services to require multifactor authentication using PIV credentials for authenticating privileged user accounts. Although the CAC is a PIV credential, it should not be used for privileged accounts, but rather only for non-privileged accounts.","ccis":["CCI-000765"]},{"vulnId":"V-204662","ruleId":"SV-204662r960975_rule","severity":"medium","ruleTitle":"AAA Services must be configured to require multifactor authentication using Common Access Card (CAC) Personal Identity Verification (PIV) credentials for authenticating non-privileged user accounts.","description":"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. \n\nMultifactor authentication uses two or more factors to achieve authentication. \n\nFactors include:\n(i) Something you know (e.g., password/PIN); \n(ii) Something you have (e.g., cryptographic identification device, token); or \n(iii) Something you are (e.g., biometric). \n\nA non-privileged account is any information system account with authorizations of a non-privileged user. \n\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\n\nApplications integrating with the DoD Active Directory and using the DoD CAC are examples of compliant multifactor authentication solutions.","checkContent":"Verify AAA Services are configured to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts.\n\nIf AAA Services are not configured to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts, this is a finding.","fixText":"Configure AAA Services to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts.","ccis":["CCI-000766"]},{"vulnId":"V-204663","ruleId":"SV-204663r960999_rule","severity":"medium","ruleTitle":"AAA Services used for 802.1x must be configured to uniquely identify network endpoints (supplicants) before the authenticator establishes any connection.","description":"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\n\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to workstations, printers, servers [outside a datacenter], VoIP phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.","checkContent":"If AAA Services are not used for 802.1x endpoint identification and authentication, this is not applicable.\n\nVerify AAA Services are configured to uniquely identify supplicants before the authenticator establishes any connection.\n\nIf AAA Services are not configured to uniquely identify supplicants before the authenticator establishes any connection, this is a finding.","fixText":"Configure AAA Services for 802.1x identification and authentication to uniquely identify supplicants before the authenticator establishes any connection.","ccis":["CCI-000778"]},{"vulnId":"V-204664","ruleId":"SV-204664r981554_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce a minimum 15-character password length.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce a minimum 15-character password length. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to enforce a minimum 15-character password length, this is a finding.","fixText":"Configure AAA Services to enforce a minimum 15-character password length. This includes randomly assigned passwords, shared secrets, and pre-shared keys.","ccis":["CCI-004066"]},{"vulnId":"V-204666","ruleId":"SV-204666r981558_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce password complexity by requiring that at least one uppercase character be used.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one uppercase character be used. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to require that at least one uppercase character be used, this is a finding.","fixText":"Configure AAA Services to enforce password complexity by requiring that at least one uppercase character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.","ccis":["CCI-004066"]},{"vulnId":"V-204667","ruleId":"SV-204667r981561_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce password complexity by requiring that at least one lowercase character be used.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one lowercase character be used. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to require that at least one lowercase character be used, this is a finding.","fixText":"Configure AAA Services to enforce password complexity by requiring that at least one lowercase character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.","ccis":["CCI-004066"]},{"vulnId":"V-204668","ruleId":"SV-204668r981562_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce password complexity by requiring that at least one numeric character be used.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one numeric character be used. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to require that at least one numeric character be used, this is a finding.","fixText":"Configure AAA Services to enforce password complexity by requiring that at least one numeric character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.","ccis":["CCI-004066"]},{"vulnId":"V-204669","ruleId":"SV-204669r981563_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce password complexity by requiring that at least one special character be used.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Special characters are those characters that are not alphanumeric. Examples include: ~ ! @ # $ % ^ *.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one special character be used. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to require that at least one special character be used, this is a finding.","fixText":"Configure AAA Services to enforce password complexity by requiring that at least one special character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.","ccis":["CCI-004066"]},{"vulnId":"V-204670","ruleId":"SV-204670r1043189_rule","severity":"medium","ruleTitle":"AAA Services must be configured to require the change of at least eight of the total number of characters when passwords are changed.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nWhere passwords are used, verify AAA Services are configured to require the change of at least eight of the total number of characters when passwords are changed. This requirement may be verified by demonstration or configuration review.\n\nIf AAA Services are not configured to require the change of at least eight of the total number of characters when passwords are changed, this is a finding.","fixText":"Configure AAA Services to require the change of at least eight of the total number of characters when passwords are changed. \n\nNote: The best practice would be to require that all characters must be changed with each password change, especially for privileged accounts.","ccis":["CCI-004066"]},{"vulnId":"V-204671","ruleId":"SV-204671r981567_rule","severity":"high","ruleTitle":"For password-based authentication, AAA Services must be configured to store passwords using an approved salted key derivation function, preferably using a keyed hash.","description":"Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.\n\nAAA Services must enforce cryptographic representations of passwords when storing passwords in databases, configuration files, and log files. Passwords must be protected at all times. Using a strong, one-way hashing encryption algorithm with a salt is the standard method for providing a means to validate a password without having to store the actual password.\n\nPerformance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security. If passwords are stored in clear text, they can be plainly read and easily compromised.","checkContent":"Where passwords are used, verify AAA Services are configured to encrypt locally stored credentials using a FIPS-validated cryptographic module. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose. \n\nConfirm databases, configuration files, and log files have encrypted representations for all passwords, and that no password strings are readable/discernable. Potential locations include the local file system where configurations and events are stored, or in a related database table.\n\nReview AAA Services configuration for use of the MD5 algorithm to create password hashes.\n\nIf AAA Services are not configured to encrypt locally stored credentials using a FIPS-validated cryptographic module, this is a finding.\n\nIf AAA Services are configured to use MD5 to create password hashes, this is a finding.\n\nNote: FIPS-validated cryptographic modules are listed on the NIST Cryptographic Module Validation Program's (CMVP) validation list.","fixText":"Configure AAA Services to encrypt locally stored credentials using a FIPS-validated cryptographic module.\n\nConfigure all associated databases, configuration files, and audit files to use only encrypted representations for all passwords so that no password strings are readable/discernable.","ccis":["CCI-004062"]},{"vulnId":"V-204672","ruleId":"SV-204672r961029_rule","severity":"high","ruleTitle":"AAA Services must be configured to encrypt transmitted credentials using a FIPS-validated cryptographic module.","description":"Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.\n\nAAA Services can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.","checkContent":"Where passwords are used, verify AAA Services are configured to encrypt transmitted credentials using a FIPS-validated cryptographic module. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose.\n \nIf AAA Services are not configured to encrypt transmitted credentials using a FIPS-validated cryptographic module, this is a finding.\n\nNote: FIPS-validated cryptographic modules are listed on the NIST Cryptographic Module Validation Program's (CMVP) validation list.","fixText":"Configure AAA Services to encrypt transmitted credentials using a FIPS-validated cryptographic module.","ccis":["CCI-000197"]},{"vulnId":"V-204673","ruleId":"SV-204673r981570_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce 24 hours as the minimum password lifetime.","description":"Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement.\n\nRestricting this setting limits the user's ability to change their password. Passwords need to be changed at specific policy based intervals; however, if the application allows the user to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g., shared secrets, pre-shared keys) or the account of last resort.\n\nWhere passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to enforce 24 hours as the minimum password lifetime. When the AAA Services configuration setting is for \"1 day\", it is required that the length be 24 hours.\n\nIf AAA Services are not configured to enforce 24 hours as the minimum password lifetime, this is a finding.","fixText":"Configure AAA Services to enforce 24 hours as the minimum password lifetime. When the AAA Services configuration setting is for \"1 day\", it is required that the length be 24 hours. This requirement is not applicable to service account passwords (e.g., shared secrets, pre-shared keys) or the account of last resort.","ccis":["CCI-004066"]},{"vulnId":"V-204674","ruleId":"SV-204674r1043190_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce a 60-day maximum password lifetime restriction.","description":"Any password, no matter how complex, can eventually be cracked; therefore, passwords must be changed at specific intervals. \n\nOne method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. \n\nThis requirement does not include emergency administration accounts that are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.\n\nWhere passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to enforce a 60-day maximum password lifetime restriction. Additionally, AAA Services must force password change upon the first logon after the expiration of the 60 days.\n\nIf AAA Services are not configured to enforce a 60-day maximum password lifetime restriction, this is a finding.","fixText":"Configure AAA Services to enforce a 60-day maximum password lifetime restriction. Additionally, configure AAA Services to force password change upon the first logon after the expiration of the 60 days. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.","ccis":["CCI-004066"]},{"vulnId":"V-204675","ruleId":"SV-204675r961038_rule","severity":"high","ruleTitle":"AAA Services must be configured to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication.","description":"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted.\n\nA trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nThis requirement verifies that a certification path to an accepted trust anchor is used to for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses.","checkContent":"Verify AAA Services are configured to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication.\n\nIf AAA Services are not configured to only accept certificates issued by a DoD-approved Certificate Authority, this is a finding.","fixText":"Configure AAA Services to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication.","ccis":["CCI-000185"]},{"vulnId":"V-204676","ruleId":"SV-204676r961038_rule","severity":"high","ruleTitle":"AAA Services must be configured to not accept certificates that have been revoked for PKI-based authentication.","description":"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted.\n\nA trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nThis requirement verifies that a certification path to an accepted trust anchor is used to for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses.","checkContent":"Verify AAA Services are configured to reflect certificates that have been revoked for PKI-based authentication.\n\nIf AAA Services are not configured to reject certificates that have been revoked, this is a finding.","fixText":"Configure AAA Services to not accept certificates that have been revoked for PKI-based authentication.","ccis":["CCI-000185"]},{"vulnId":"V-204677","ruleId":"SV-204677r961041_rule","severity":"medium","ruleTitle":"AAA Services must be configured to enforce authorized access to the corresponding private key for PKI-based authentication.","description":"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\n\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. \n\nIf the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. \n\nBoth the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.","checkContent":"Verify AAA Services are configured to enforce authorized access to the corresponding private key for PKI-based authentication.\n\nIf AAA Services are not configured to enforce authorized access to the corresponding private key, this is a finding.","fixText":"Configure AAA Services to enforce authorized access to the corresponding private key for PKI-based authentication.","ccis":["CCI-000186"]},{"vulnId":"V-204678","ruleId":"SV-204678r961044_rule","severity":"medium","ruleTitle":"AAA Services must be configured to map the authenticated identity to the user account for PKI-based authentication.","description":"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are configured to map the authenticated identity to the user account for PKI-based authentication.\n\nIf AAA Services are not configured to map the authenticated identity to the user account, this is a finding.","fixText":"Configure AAA Services to map the authenticated identity to the user account for PKI-based authentication.","ccis":["CCI-000187"]},{"vulnId":"V-204679","ruleId":"SV-204679r961128_rule","severity":"high","ruleTitle":"AAA Services must be configured to protect the confidentiality and integrity of all information at rest.","description":"Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive) within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of their data storage (e.g., hard drives and non-volatile memory) can be read, copied, or altered. Applications and application users generate information throughout the course of their application use.\n\nThis requirement addresses protection of user-generated data, as well as, operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information.","checkContent":"Verify AAA Services are configured to protect the confidentiality and integrity of all information at rest. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose. Potential locations include the local file system where configurations and events are stored or in a related database table.\n\nIf AAA Services are not configured to protect the confidentiality and integrity of all information at rest, this is a finding.","fixText":"Configure AAA Services to protect the confidentiality and integrity of all information at rest. AAA Services may leverage the capability of an operating system or require the use of a purpose-built module for this purpose. Potential locations include the local file system where configurations and events are stored or in a related database table.","ccis":["CCI-001199"]},{"vulnId":"V-204680","ruleId":"SV-204680r971528_rule","severity":"medium","ruleTitle":"AAA Services must be configured to prevent automatically removing emergency accounts.","description":"Emergency accounts are administrator accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account that is created for use by vendors or system maintainers, that is removed once the crisis has passed. When AAA Services do not perform account management, the connected Active Directory must provide this setting","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to not automatically remove emergency accounts. Emergency accounts must not have automatic termination set.\n\nIf AAA Services are configured to automatically remove emergency accounts, this is a finding.","fixText":"Configure AAA Services to not automatically remove emergency accounts. Emergency accounts must not have automatic termination set.","ccis":["CCI-001682"]},{"vulnId":"V-204681","ruleId":"SV-204681r971528_rule","severity":"low","ruleTitle":"AAA Services must be configured to prevent automatically disabling emergency accounts.","description":"Emergency accounts are administrator accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account that is created for use by vendors or system maintainers, that is removed once the crisis has passed. When AAA Services do not perform account management, the connected Active Directory must provide this setting.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are configured to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set.\n\nIf AAA Services are configured to automatically disable emergency accounts, this is a finding.","fixText":"Configure AAA Services to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set.","ccis":["CCI-001682"]},{"vulnId":"V-204682","ruleId":"SV-204682r981574_rule","severity":"medium","ruleTitle":"AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) when accounts are created.","description":"Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Sending notification of account creation events to the system administrator and ISSO is one method for mitigating this risk. \n\nAAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to notify the SAs and ISSO when accounts are created.\n\nIf AAA Services are not configured to notify the SAs and ISSO when accounts are created, this is a finding.","fixText":"Configure AAA Services to notify the SAs and the ISSO when accounts are created.","ccis":["CCI-000015"]},{"vulnId":"V-204683","ruleId":"SV-204683r981577_rule","severity":"medium","ruleTitle":"AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) when accounts are modified.","description":"When application accounts are modified, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account modification events to the SA and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nAAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g., SNMP, SIEM) to perform the notification.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to notify the SAs and the ISSO when accounts are modified.\n\nIf AAA Services are not configured to notify the SAs and the ISSO when accounts are modified, this is a finding.","fixText":"Configure AAA Services to notify the SAs and the ISSO when accounts are modified.","ccis":["CCI-000015"]},{"vulnId":"V-204684","ruleId":"SV-204684r981580_rule","severity":"medium","ruleTitle":"AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) for account disabling actions.","description":"When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account disabling events to the SA and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nAAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g., SNMP, SIEM) to perform the notification.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to notify the SAs and the ISSO for account disabling actions.\n\nIf AAA Services are not configured to notify the SAs and the ISSO for account disabling actions, this is a finding.","fixText":"Configure AAA Services to notify the SAs and the ISSO for account disabling actions.","ccis":["CCI-000015"]},{"vulnId":"V-204685","ruleId":"SV-204685r981583_rule","severity":"medium","ruleTitle":"AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) for account removal actions.","description":"When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying users or for identifying the application processes themselves. Sending notification of account removal events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nAAA Services may not have built-in capabilities to notify system administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to notify the SAs and the ISSO for account removal actions.\n\nIf AAA Services are not configured to notify the SAs and the ISSO for account removal actions, this is a finding.","fixText":"Configure AAA Services to notify the SAs and the ISSO for account removal actions.","ccis":["CCI-000015"]},{"vulnId":"V-204686","ruleId":"SV-204686r961290_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically audit account enabling actions.","description":"Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Automatically auditing account enabling actions provides logging that can be used for forensic purposes.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to automatically audit account enabling actions.\n\nIf AAA Services are not configured to automatically audit account enabling actions, this is a finding.","fixText":"Configure AAA Services to automatically audit account enabling actions.","ccis":["CCI-002130"]},{"vulnId":"V-204687","ruleId":"SV-204687r981586_rule","severity":"medium","ruleTitle":"AAA Services must be configured to notify system administrators (SAs) and information system security officer (ISSO) of account enabling actions.","description":"Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Sending notification of account enabling events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nIn order to detect and respond to events that affect user accessibility and application processing, the AAA or directory services must notify the appropriate individuals so they can investigate the event. \n\nAAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. \n\nVerify AAA Services are configured to notify the SAs and the ISSO of account enabling actions.\n\nIf AAA Services are not configured to notify the SAs and the ISSO of account enabling actions, this is a finding.","fixText":"Configure AAA Services to notify the SAs and the ISSO of account enabling actions.","ccis":["CCI-000015"]},{"vulnId":"V-204689","ruleId":"SV-204689r961368_rule","severity":"medium","ruleTitle":"AAA Services must be configured to maintain locks on user accounts until released by an administrator.","description":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are configured to maintain locks on user accounts until released by an administrator.\n\nIf AAA Services are not configured to maintain locks on user accounts until released by an administrator, this is a finding.","fixText":"Configure AAA Services to maintain locks on user accounts until released by an administrator.","ccis":["CCI-002238"]},{"vulnId":"V-204690","ruleId":"SV-204690r961395_rule","severity":"medium","ruleTitle":"AAA Services must be configured to send audit records to a centralized audit server.","description":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.","checkContent":"Verify AAA Services are configured to send audit records to a centralized audit server.\n\nIf AAA Services are not configured to send audit records to a centralized audit server, this is a finding.","fixText":"Configure AAA Services to send audit records to a centralized audit server.","ccis":["CCI-001851"]},{"vulnId":"V-204691","ruleId":"SV-204691r961443_rule","severity":"medium","ruleTitle":"AAA Services must be configured to use or map to Coordinated Universal Time (UTC) to record time stamps for audit records.","description":"If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis.\n\nTime stamps generated by the application include date and time. Time is commonly expressed in Coordinated Universal Time (UTC) or local time with an offset from UTC.","checkContent":"Verify AAA Services are configured to use or map to UTC to record time stamps for audit records. The audit records must either show UTC time or an offset to UTC time for each entry.\n\nIf AAA Services are not configured to use or map to UTC to record time stamps for audit records, this is a finding.","fixText":"Configure AAA Services to use or map to UTC to record time stamps for audit records.","ccis":["CCI-001890"]},{"vulnId":"V-204692","ruleId":"SV-204692r961446_rule","severity":"medium","ruleTitle":"AAA Services must be configured with a minimum granularity of one second to record time stamps for audit records.","description":"Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records. \n\nTime stamps generated by the application include date and time. Granularity of time measurements refers to the degree of synchronization between information system clocks and reference clocks.","checkContent":"Verify AAA Services are configured with a minimum granularity of one second to record time stamps for audit records.\n\nIf AAA Services are not configured with a minimum granularity of one second to record time stamps for audit records, this is a finding.","fixText":"Configure AAA Services with a minimum granularity of one second to record time stamps for audit records.","ccis":["CCI-001889"]},{"vulnId":"V-204693","ruleId":"SV-204693r961503_rule","severity":"medium","ruleTitle":"AAA Services used for 802.1x must be configured to authenticate network endpoint devices (supplicants) before the authenticator establishes any connection.","description":"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\n\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to workstations, printers, servers [outside a datacenter], VoIP phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply. \n\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.","checkContent":"If AAA Services are not used for 802.1x endpoint identification and authentication, this is not applicable.\n\nVerify AAA Services are configured to authenticate supplicants before the authenticator establishes any connection.\n\nIf AAA Services are not configured to authenticate supplicants before the authenticator establishes any connection, this is a finding.","fixText":"Configure AAA Services to authenticate supplicants before the authenticator establishes any connection.","ccis":["CCI-001958"]},{"vulnId":"V-204695","ruleId":"SV-204695r981588_rule","severity":"low","ruleTitle":"AAA Services must be configured to use at least two NTP servers to synchronize time.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. \n\nIf the internal clock is not used, the system may not be able to provide time stamps for log messages. Additionally, externally generated time stamps may not be accurate. Applications can use the capability of an operating system or purpose-built module for this purpose. Synchronizing the internal clock using NTP provides uniformity for all system clocks over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.","checkContent":"Verify AAA Services are configured to use at least two NTP servers to synchronize time. Both a primary and backup NTP server must be identified in the configuration. AAA Services may leverage the capability of an operating system.\n\nIf AAA Services are not configured to use at least two separate NTP servers, this is a finding.","fixText":"Configure AAA Services to use two separate NTP servers. Both a primary and backup NTP server must be identified in the configuration.","ccis":["CCI-004923"]},{"vulnId":"V-204696","ruleId":"SV-204696r981589_rule","severity":"medium","ruleTitle":"AAA Services must be configured to authenticate all NTP messages received from NTP servers and peers.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. \n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source. NTP may pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. \n\nTwo NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka \"symmetric mode\"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.\n\nA hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. \n\nThe NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.","checkContent":"Verify AAA Services are configured to authenticate all NTP messages received from NTP servers and peers. \n\nThe NTP server or peer authentication must use a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. AAA Services may leverage the capability of an operating system.\n\nIf AAA Services are not configured to authenticate all NTP messages using a FIPS-approved message authentication code algorithm, this is a finding.\n\nIf AAA Services are not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, but are configured to use an MD5 for NTP message authentication, this is downgraded to a CAT III.","fixText":"Configure AAA Services to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm. When AAA Services are not capable of using FIPS-approved message authentication code algorithms, configure AAA Services to use MD5 message authentication code algorithms.","ccis":["CCI-004923"]},{"vulnId":"V-204697","ruleId":"SV-204697r961863_rule","severity":"low","ruleTitle":"AAA Services must be configured to use their loopback or OOB management interface address as the source address when originating NTP traffic.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. \n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.\n\nUsing a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address.","checkContent":"Verify AAA Services are configured to use their loopback interface address as the source address when originating NTP traffic. When AAA Services are managed from an OOB management network, the OOB interface must be used instead of the loopback address for originating NTP traffic.\n\nIf AAA Services are not configured to use the OOB interface when managed from an OOB management network, this is a finding.\n\nIf AAA Services are not configured to use the loopback or OOB management interface as the source address when originating NTP traffic, this is a finding.","fixText":"Configure AAA Services to use their loopback or OOB management interface address as the source address when originating NTP traffic.","ccis":["CCI-000366"]},{"vulnId":"V-204698","ruleId":"SV-204698r961863_rule","severity":"medium","ruleTitle":"AAA Services used for 802.1x must be configured to use secure Extensible Authentication Protocol (EAP), such as EAP-TLS, EAP-TTLS, and PEAP.","description":"Additional new EAP methods/types are still being proposed. However, the three being considered secure are EAP-TLS, EAP-TTLS, and PEAP. PEAP is the preferred EAP type to be used in DoD for its ability to support a greater number of operating systems and its capability to transmit statement of health information, per NSA NAC study.\n\nLightweight EAP (LEAP) is a CISCO proprietary protocol providing an easy-to-deploy one-password authentication. LEAP is vulnerable to dictionary attacks. A \"man in the middle\" can capture traffic, identify a password, and then use it to access a WLAN. LEAP is inappropriate and does not provide sufficient security for use on DOD networks.\n\nEAP-MD5 is functionally similar to CHAP and is susceptible to eavesdropping because the password credentials are sent as a hash (not encrypted). In addition, server administrators would be required to store unencrypted passwords on their servers violating other security policies. EAP-MD5 is inappropriate and does not provide sufficient security for use on DOD networks.","checkContent":"Verify AAA Services used for 802.1x are configured to use secure EAP. Currently acceptable secure protocols are EAP-TLS, EAP-TTLS, and PEAP.\n\nIf AAA Services used for 802.1x are not configured to use secure EAP, this is a finding.","fixText":"Configure AAA Services used for 802.1x to use secure EAP, such as EAP-TLS, EAP-TTLS, and PEAP.","ccis":["CCI-000366"]},{"vulnId":"V-204699","ruleId":"SV-204699r961863_rule","severity":"medium","ruleTitle":"AAA Services must not be configured with shared accounts.","description":"Shared accounts configured for use on a network device do not allow for accountability or repudiation of individuals using them. If shared accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having shared accounts does not allow for proper auditing of who is accessing or changing the network. For this reason, shared accounts are not permitted.","checkContent":"If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function.\n\nVerify AAA Services are not configured with shared accounts. Identify group profile definitions that do not meet the accounts user-id naming convention. \n\nBelow is a super-user example of how an SA profile may be associated.\n\nGroup Profile Information\ngroup = super-user{\nprofile_id = 40\nprofile_cycle = 1\nservice=shell {\ndefault cmd=permit\ncmd=debug {\ndeny all\npermit .*\n}\n}\n}\n\nBelow is an example of the user definition that should be assigned with a valid ID (not rtr-geek). Look for group accounts here:\n\nuser = rtr-geek{\nprofile_id = 45\nprofile_cycle = 1\nmember = rtr_super\npassword = des \"********\"\n}\n\nIf AAA Services are configured with shared accounts (group profiles), this is a finding.","fixText":"Configure AAA Services with no shared accounts. Remove all group profiles.","ccis":["CCI-000366"]},{"vulnId":"V-204700","ruleId":"SV-204700r961863_rule","severity":"medium","ruleTitle":"AAA Services used to authenticate privileged users for device management must be configured to connect to the management network.","description":"Using standardized authentication protocols such as RADIUS, TACACS+, and Kerberos, an authentication server provides centralized and robust authentication services for the management of network components. In order to control access to the servers as well as monitor traffic to them, the authentication servers should only be connected to the management network.","checkContent":"If AAA Services are not used for authentication of privileged users to AAA Services, this is not applicable.\n\nVerify AAA Services are configured to connect to the management network. Confirm AAA Services are not dual-homed by physically inspecting the physical LAN connection.\n\nIf AAA Services are configured to connect to a non-management network, this is a finding.","fixText":"Configure AAA Services used to authenticate privileged users for device management to connect to the management network.","ccis":["CCI-000366"]},{"vulnId":"V-204701","ruleId":"SV-204701r961863_rule","severity":"medium","ruleTitle":"AAA Services must be configured to use a unique shared secret for communication (i.e. RADIUS, TACACS+) with clients requesting authentication services.","description":"Using standardized authentication protocols such as RADIUS, TACACS+, and Kerberos, an authentication server provides centralized and robust authentication services for the management of network components. An authentication server is very scalable as it supports many user accounts and authentication sessions with the network components.","checkContent":"If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable.\n\nVerify AAA Services are configured to use a unique shared secret with clients requesting authentication services. The shared secret is to be the same for communication between AAA Services and the client devices. All shared secrets must meet password complexity requirements.\n\nIf AAA Services are not configured to use a unique shared secret for communication with clients requesting authentication services, this is a finding.","fixText":"Configure AAA Services to use a unique shared secret for communication (i.e. RADIUS, TACACS+) with all clients requesting authentication services.","ccis":["CCI-000366"]},{"vulnId":"V-204702","ruleId":"SV-204702r961863_rule","severity":"medium","ruleTitle":"AAA Services must be configured to use IP segments separate from production VLAN IP segments.","description":"When policy assessment and remediation have been implemented and the advanced AAA server dynamic VLAN is misconfigured, logical separation of the production VLAN may not be assured.\n\nNon-trusted resources are resources that are not authenticated in a NAC solution implementing only the authentication component of NAC. Non-trusted resources could become resources that have been authenticated but have not had a successful policy assessment when the automated policy assessment component has been implemented.","checkContent":"If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable.\n\nVerify AAA Services are configured to use IP segments separate from production VLAN IP segments. \n\nIf AAA Services are not configured to use IP segments separate from production VLAN IP segments, this is a finding.","fixText":"Configure AAA Services to use IP segments separate from production VLAN IP segments.","ccis":["CCI-000366"]},{"vulnId":"V-204703","ruleId":"SV-204703r961863_rule","severity":"medium","ruleTitle":"AAA Services must be configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access.","description":"Devices having an IP address that do not pass authentication can be used to attack compliant devices if they share VLANs. When devices proceed into the NAC AAA (radius) functions they must originate in the Unauthorized VLAN by default. If the device fails authentication, it should be denied IP capability and movement to other dynamic VLANs used in the NAC process flow or moved to a VLAN that has limited capability such as a Guest VLAN with internet access, but without access to production assets.","checkContent":"If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable.\n\nVerify AAA Services are configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access. If the SA has created a dynamic Unauthorized VLAN, definitions should not have an IP pool assignment. Ensure the Unauthorized VLAN is configured without IP or a Guest VLAN is defined with limited access.\n\nIf AAA Services are not configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access, this is a finding.","fixText":"Configure AAA Services to place non-authenticated network access requests in the Unauthorized VLAN without access to production data. Implement a NAC solution where the device remains without IP assignment if authentication fails or create a dynamic Unauthorized VLAN/Guest VLAN with limited access in AAA server. If a Guest VLAN is built, it should not have access to production data.","ccis":["CCI-000366"]},{"vulnId":"V-204704","ruleId":"SV-204704r961863_rule","severity":"medium","ruleTitle":"AAA Services must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.","description":"Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. \n\nConfiguration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.","checkContent":"Determine if AAA Services are configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.\n\nIf AAA Services are not configured in accordance with the designated security configuration settings, this is a finding.","fixText":"Configure the network device to be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.","ccis":["CCI-000366"]},{"vulnId":"V-263527","ruleId":"SV-263527r982381_rule","severity":"medium","ruleTitle":"AAA Services must be configured to disable accounts when the accounts have expired.","description":"Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.","checkContent":"Verify AAA Services is configured to disable accounts when the accounts have expired.\n\nIf AAA Services is not configured to disable accounts when the accounts have expired, this is a finding.","fixText":"Configure AAA Services to disable accounts when the accounts have expired.","ccis":["CCI-003627"]},{"vulnId":"V-263528","ruleId":"SV-263528r982383_rule","severity":"medium","ruleTitle":"AAA Services must be configured to disable accounts when the accounts are no longer associated to a user.","description":"Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.","checkContent":"Verify AAA Services is configured to disable accounts when the accounts are no longer associated to a user.\n\nIf AAA Services is not configured to disable accounts when the accounts are no longer associated to a user, this is a finding.","fixText":"Configure AAA Services to disable accounts when the accounts are no longer associated to a user.","ccis":["CCI-003628"]},{"vulnId":"V-263529","ruleId":"SV-263529r982385_rule","severity":"medium","ruleTitle":"AAA Services must be configured to disable accounts when the accounts are in violation of organizational policy.","description":"Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.","checkContent":"Verify AAA Services is configured to disable accounts when the accounts are in violation of organizational policy.\n\nIf AAA Services is not configured to disable accounts when the accounts are in violation of organizational policy, this is a finding.","fixText":"Configure AAA Services to disable accounts when the accounts are in violation of organizational policy.","ccis":["CCI-003629"]},{"vulnId":"V-263530","ruleId":"SV-263530r982387_rule","severity":"medium","ruleTitle":"AAA Services must be configured to automatically generate audit records of the enforcement actions.","description":"Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.","checkContent":"Verify AAA Services is configured to automatically generate audit records of the enforcement actions.\n\nIf AAA Services is not configured to automatically generate audit records of the enforcement actions, this is a finding.","fixText":"Configure AAA Services to automatically generate audit records of the enforcement actions.","ccis":["CCI-003938"]},{"vulnId":"V-263531","ruleId":"SV-263531r982389_rule","severity":"medium","ruleTitle":"AAA Services must be configured to require users to be individually authenticated before granting access to the shared accounts or resources.","description":"Individual authentication prior to shared group authentication mitigates the risk of using group accounts or authenticators.","checkContent":"Verify AAA Services is configured to require users to be individually authenticated before granting access to the shared accounts or resources.\n\nIf AAA Services is not configured to require users to be individually authenticated before granting access to the shared accounts or resources, this is a finding.","fixText":"Configure AAA Services to require users to be individually authenticated before granting access to the shared accounts or resources.","ccis":["CCI-004045"]},{"vulnId":"V-263532","ruleId":"SV-263532r981607_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to update the list of passwords on an organization-defined frequency.","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to update the list of passwords on an organization-defined frequency.\n\nIf AAA Services is not configured to update the list of passwords on an organization-defined frequency, this is a finding.","fixText":"Configure AAA Services to update the list of passwords on an organization-defined frequency.","ccis":["CCI-004059"]},{"vulnId":"V-263533","ruleId":"SV-263533r981610_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.\n\nIf AAA Services is not configured to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly, this is a finding.","fixText":"Configure AAA Services to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.","ccis":["CCI-004060"]},{"vulnId":"V-263534","ruleId":"SV-263534r981613_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to verify when users create or update passwords, and that the passwords are not on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).\n\nIf AAA Services is not configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), this is a finding.","fixText":"Configure AAA Services to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).","ccis":["CCI-004061"]},{"vulnId":"V-263535","ruleId":"SV-263535r981616_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to require immediate selection of a new password upon account recovery.","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to require immediate selection of a new password upon account recovery.\n\nIf AAA Services is not configured to require immediate selection of a new password upon account recovery, this is a finding.","fixText":"Configure AAA Services to require immediate selection of a new password upon account recovery.","ccis":["CCI-004063"]},{"vulnId":"V-263536","ruleId":"SV-263536r981619_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to allow user selection of long passwords and passphrases, including spaces and all printable characters.","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to allow user selection of long passwords and passphrases, including spaces and all printable characters.\n\nIf AAA Services is not configured to allow user selection of long passwords and passphrases, including spaces and all printable characters, this is a finding.","fixText":"Configure AAA Services to allow user selection of long passwords and passphrases, including spaces and all printable characters.","ccis":["CCI-004064"]},{"vulnId":"V-263537","ruleId":"SV-263537r981622_rule","severity":"medium","ruleTitle":"For password-based authentication, AAA Services must be configured to employ automated tools to assist the user in selecting strong password authenticators.","description":"Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.","checkContent":"Verify AAA Services is configured to employ automated tools to assist the user in selecting strong password authenticators.\n\nIf AAA Services is not configured to employ automated tools to assist the user in selecting strong password authenticators, this is a finding.","fixText":"Configure AAA Services to employ automated tools to assist the user in selecting strong password authenticators.","ccis":["CCI-004065"]},{"vulnId":"V-263538","ruleId":"SV-263538r981625_rule","severity":"medium","ruleTitle":"For public key-based authentication, AAA Services must be configured to implement a local cache of revocation data to support path discovery and validation.","description":"Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.","checkContent":"Verify AAA Services is configured to implement a local cache of revocation data to support path discovery and validation.\n\nIf AAA Services is not configured to implement a local cache of revocation data to support path discovery and validation, this is a finding.","fixText":"Configure AAA Services to implement a local cache of revocation data to support path discovery and validation.","ccis":["CCI-004068"]},{"vulnId":"V-263539","ruleId":"SV-263539r981628_rule","severity":"medium","ruleTitle":"AAA Services must be configured to include only approved trust anchors in trust stores or certificate stores managed by the organization.","description":"Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.","checkContent":"Verify AAA Services is configured to include only approved trust anchors in trust stores or certificate stores managed by the organization.\n\nIf AAA Services is not configured to include only approved trust anchors in trust stores or certificate stores managed by the organization, this is a finding.","fixText":"Configure AAA Services to include only approved trust anchors in trust stores or certificate stores managed by the organization.","ccis":["CCI-004909"]}]}