V-217397

Discussion

To assure individual accountability and prevent unauthorized access, administrators must be individually identified and authenticated. Individual accountability mandates that each administrator is uniquely identified. A group authenticator is a shared account or some other form of authentication that allows multiple unique individuals to access the network device using a single account. If a device allows or provides for group authenticators, it must first individually authenticate administrators prior to implementing group authenticator functionality. Some devices may not have the need to provide a group authenticator; this is considered a matter of device design. In those instances where the device design includes the use of a group authenticator, this requirement will apply. This requirement applies to accounts created and managed on or by the network device.

Check Content

Verify the BIG-IP appliance is configured to authenticate administrators with an individual authenticator prior to using a group authenticator. 

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify "Authentication: User Directory" is configured for an approved remote authentication server that authenticates administrators to an administrators group.

Navigate to System >> Users >> Remote Role Groups.

Verify that administrators are assigned to the Administrator Role.

If the BIG-IP appliance is not configured to authenticate administrators with an individual authenticator prior to using a group authenticator, this is a finding.