V-279435

Discussion

Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing his account was compromised, multifactor authentication adds the requirement the attacker must have something from the user, such as a token, or to biometrically be the user. Multifactor authentication is defined as using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). A CAC or PKI Hardware Token meets this definition. A privileged account is defined as an information system account with authorizations of a privileged user. These accounts would be capable of accessing the command line management interface. When accessing the application server via a local connection, administrative access to the application server must be PKI hardware token enabled.

Check Content

Confirm the Nutanix VM application server Envoy Reverse Proxy server only has one local account, and that it is the account of last resort. The Envoy Reverse Proxy server relies on AD for user management.

1. Log in to Prism Element.
2. Click the gear icon in the upper-right corner.
3. Navigate to Authentication settings.

If an Active Directory or OpenLDAP servers are not configured, this is a finding.