V-268222

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement.

Check Content

Review the Self-Service menu within HYCU to view accounts and user roles (Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer).

User roles have a predefined and nonchangeable set of user privileges. To check exact set of privileges of each user, navigate to Self-Service context in the HYCU UI.

Click on the question mark in the upper-right corner, followed by "Help with This Page". Scroll down to the "User Roles" section.

If users can perform more functions than those specified for their role, this is a finding.