Authentication, Authorization, and Accounting Services (AAA) Security Requirements Guide
| Version 1 Release 2 |
| 2020-01-24 |
| U_AAA_Services_SRG_V1R2_Manual-xccdf.xml |
| This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. |
Vulnerabilities (69)
AAA Services must be configured to use secure protocols when connecting to directory services.
Discussion
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected utilizing transport encryption protocols, such as TLS. TLS provides a means to authenticate sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.
Fix Text
Configure AAA Services to use secure protocols when connecting to directory services. The use of LDAP over TLS (LDAPS) is the most common method to secure the directory services or user database traffic. However, proprietary or other protocols may be used in some configurations. Each protocol egressing the local enclave must be implemented in accordance with its PPSM CAL.
Check Content
If AAA Services do not connect to a directory services or other identity provider, but instead perform user and device account management as part of their functionality, this is not applicable. Review the AAA Services configuration when connecting to directory services or another identity provider. Verify the connection is configured to use secure protocols for transport between AAA Services and the directory services using mutual authentication. The use of LDAP over TLS (LDAPS) is the most common method to secure the directory services or user database traffic. Each protocol egressing the local enclave must be implemented in accordance with its PPSM CAL. If AAA Services do not use secure protocols when connecting to directory services, this is a finding. If the protocols are not implemented in accordance with the PPSM CAL, this is a finding.
AAA Services must be configured to use protocols that encrypt credentials when authenticating clients, as defined in the PPSM CAL and vulnerability assessments.
Discussion
Authentication protection of the client credentials (specifically the password or shared secret) prevents unauthorized access to resources. The RADIUS protocol encrypts the password field in the access-request packet, from the client to the AAA server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third-party. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. Other protocols have similar protections. When unencrypted credentials are passed, adversaries can gain access to resources.
Fix Text
Configure AAA Services to use protocols that encrypt credentials when authenticating clients. Both the RADIUS and TACACS+ protocols are acceptable when configured to perform encryption. For any protocol implemented, the PPSM CAL and vulnerability assessments must be reviewed to ensure the protocols are properly configured.
Check Content
Verify AAA Services are configured to use protocols that encrypt credentials when authenticating clients. Both the RADIUS and TACACS+ protocols are acceptable when configured to perform encryption. For any protocol implemented, the PPSM CAL and vulnerability assessments must be reviewed to ensure the protocols are properly configured. If AAA Services are not configured to use protocols that encrypt credentials when authenticating clients, as defined in the PPSM CAL and vulnerability assessments, this is a finding.
AAA Services must be configured to provide automated account management functions.
Discussion
Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. A comprehensive account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to disable inactive accounts after a specified time period, or to lock accounts after a specified number of unsuccessful attempts at logon. AAA Services must be configured to automatically provide account management functions, and these functions must immediately enforce the organization's current account policy. The automated mechanisms may reside within AAA Services or may be directory services providing automated account management externally. Automated mechanisms may be composed of differing technologies that when placed together contain an overall automated mechanism supporting an organization's automated account management requirements. Account management functions include assignment of role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example, using email or text messaging to automatically notifying account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephonic notification to report atypical system account usage.
Fix Text
Configure AAA Services to provide automated account management functions. Automated functions include disabling accounts after specified periods of inactivity, locking accounts after a specified number of incorrect logon attempts, etc. Where possible, automated functions must be performed on users and devices globally rather than by each individual account.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to provide automated account management functions. Automated functions include disabling accounts after specified periods of inactivity, locking accounts after a specified number of incorrect logon attempts, etc. Where possible, automated functions must be performed on users and devices globally rather than by each individual account. If AAA Services do not provide automated account management functions, this is a finding.
AAA Services must be configured to automatically remove authorizations for temporary user accounts after 72 hours.
Discussion
When temporary user accounts remain active after no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary user accounts must be set upon account creation. Disabling a temporary account provides a higher risk alternative; disabling allows an insider adversary to enable the privileged account and make it permanent. Temporary accounts, when used, mandate that AAA Services must be configured to automatically terminate these types of accounts after 72 hours. When AAA Services do not perform account management, the connected Active Directory must provide this setting.
Fix Text
Configure AAA Services to automatically remove authorizations for temporary user accounts after 72 hours.
Check Content
If AAA Services do not provide authorizations based on external directory services, this is not applicable. Verify AAA Services are configured to automatically remove authorizations for temporary user accounts after 72 hours. If the AAA Services configuration does not automatically remove authorizations for temporary user accounts after 72 hours, this is a finding.
AAA Services must be configured to prevent automatically removing emergency accounts.
Discussion
Emergency accounts are administrator accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. Emergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account that is created for use by vendors or system maintainers, that is removed once the crisis has passed. When AAA Services do not perform account management, the connected Active Directory must provide this setting
Fix Text
Configure AAA Services to not automatically remove emergency accounts. Emergency accounts must not have automatic termination set.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to not automatically remove emergency accounts. Emergency accounts must not have automatic termination set. If AAA Services are configured to automatically remove emergency accounts, this is a finding.
AAA Services must be configured to prevent automatically disabling emergency accounts.
Discussion
Emergency accounts are administrator accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. Emergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account that is created for use by vendors or system maintainers, that is removed once the crisis has passed. When AAA Services do not perform account management, the connected Active Directory must provide this setting.
Fix Text
Configure AAA Services to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set. If AAA Services are configured to automatically disable emergency accounts, this is a finding.
AAA Services must be configured to automatically disable accounts after a 35-day period of account inactivity.
Discussion
Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications need to track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise. This policy does not apply to either emergency accounts or an infrequently used account (e.g., account of last resort). Infrequently used accounts are local logon administrator accounts used by system administrators when network or normal logon/access is not available. Emergency accounts are administrator accounts created in response to crisis situations.
Fix Text
Configure AAA Services to automatically disable accounts after a 35-day period of account inactivity.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically disable accounts after a 35-day period of account inactivity. If the AAA Services configuration does not automatically disable accounts after a 35-day period of account inactivity, this is a finding.
AAA Services must be configured to automatically audit account creation.
Discussion
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply create a new account. Auditing of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the creation of user accounts and, as required, notifies administrators and/or managers. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.
Fix Text
Configure AAA Services to automatically audit account creation.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically audit account creation. If AAA Services are not configured to automatically audit account creation, this is a finding.
AAA Services must be configured to automatically audit account modification.
Discussion
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply modify an existing account. Auditing of account modification is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the modification of user accounts and, as required, notifies administrators and/or managers. Such a process greatly reduces the risk that accounts will be surreptitiously modified and provides logging that can be used for forensic purposes.
Fix Text
Configure AAA Services to automatically audit account modification.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically audit account modification. If AAA Services are not configured to automatically audit account modification, this is a finding.
AAA Services must be configured to automatically audit account disabling actions.
Discussion
When application accounts are disabled, user accessibility is affected. Once an attacker establishes access to an application, the attacker often attempts to disable authorized accounts to disrupt services or prevent the implementation of countermeasures. Auditing account disabling actions provides logging that can be used for forensic purposes.
Fix Text
Configure AAA Services to automatically audit account disabling actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically audit account disabling actions. If AAA Services are not configured to automatically audit account disabling actions, this is a finding.
AAA Services must be configured to automatically audit account removal actions.
Discussion
When application accounts are removed, user accessibility is affected. Once an attacker establishes access to an application, the attacker often attempts to remove authorized accounts to disrupt services or prevent the implementation of countermeasures. Auditing account removal actions provides logging that can be used for forensic purposes.
Fix Text
Configure AAA Services to automatically audit account removal actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically audit account removal actions. If AAA Services are not configured to automatically audit account removal actions, this is a finding.
AAA Services must be configured to notify the system administrators and ISSO when accounts are created.
Discussion
Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Sending notification of account creation events to the system administrator and ISSO is one method for mitigating this risk. AAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.
Fix Text
Configure AAA Services to notify the system administrators and ISSO when accounts are created.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to notify the system administrators and ISSO when accounts are created. If AAA Services are not configured to notify the system administrators and ISSO when accounts are created, this is a finding.
AAA Services must be configured to notify the system administrators and ISSO when accounts are modified.
Discussion
When application accounts are modified, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account modification events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes. AAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.
Fix Text
Configure AAA Services to notify the system administrators and ISSO when accounts are modified.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to notify the system administrators and ISSO when accounts are modified. If AAA Services are not configured to notify the system administrators and ISSO when accounts are modified, this is a finding.
AAA Services must be configured to notify the system administrators and ISSO for account disabling actions.
Discussion
When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account disabling events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes. AAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.
Fix Text
Configure AAA Services to notify system administrators and ISSO for account disabling actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to notify the system administrators and ISSO for account disabling actions. If AAA Services are not configured to notify the system administrators and ISSO for account disabling actions, this is a finding.
AAA Services must be configured to notify the system administrators and ISSO for account removal actions.
Discussion
When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying users or for identifying the application processes themselves. Sending notification of account removal events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes. AAA Services may not have built-in capabilities to notify system administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.
Fix Text
Configure AAA Services to notify system administrators and ISSO for account removal actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to notify the system administrators and ISSO for account removal actions. If AAA Services are not configured to notify the system administrators and ISSO for account removal actions, this is a finding.
AAA Services must be configured to automatically audit account enabling actions.
Discussion
Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Automatically auditing account enabling actions provides logging that can be used for forensic purposes.
Fix Text
Configure AAA Services to automatically audit account enabling actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically audit account enabling actions. If AAA Services are not configured to automatically audit account enabling actions, this is a finding.
AAA Services must be configured to notify system administrators and ISSO of account enabling actions.
Discussion
Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Sending notification of account enabling events to the system administrator and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes. In order to detect and respond to events that affect user accessibility and application processing, the AAA or directory services must notify the appropriate individuals so they can investigate the event. AAA Services may not have built-in capabilities to notify the administrators and ISSO and may require the use of third-party tools (e.g. SNMP, SIEM) to perform the notification.
Fix Text
Configure AAA Services to notify system administrator and ISSO of account enabling actions.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to notify system administrator and ISSO of account enabling actions. If AAA Services are not configured to notify the system administrator and ISSO of account enabling actions, this is a finding.
AAA Services must be configured to use Role-Based Access Control (RBAC) policy for levels of access authorization.
Discussion
RBAC is an access control policy that restricts information system access to authorized users. Without these security policies, access control and enforcement mechanisms will not prevent unauthorized access. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organization-defined roles. When users are assigned to the organizational roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a significant number of individuals for mid- to large-size organizations) but are instead acquired through role assignments. RBAC can be implemented either as a mandatory or discretionary form of access control.
Fix Text
Configure AAA Services to use RBAC policy for levels of access authorization. Configure AAA Services with standard accounts and assign them to privilege levels that meet their job description.
Check Content
Verify AAA Services are configured to use RBAC policy for levels of access authorization. Confirm the RBAC groups have tiered privileges, and users are in the appropriate groups. In the following TACACS+ example the user (test-user) is a member of the group “test-group”. <CSUserver>$/opt/ciscosecure/CLI/ViewProfile -p 9900 -u user-test User Profile Information user = test-user{ profile_id = 66 profile_cycle = 1 member = test-group password = des "********" } Below is an example of CiscoSecure TACACS+ server defining the privilege level. user = test-user{ password = clear "xxxxx" service = shell { set priv-lvl = 7 } } If AAA Services are not configured to use RBAC policy for levels of access authorization, this is a finding.
AAA Services must be configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.
Discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
Fix Text
Configure AAA Services to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period. If AAA Services are not configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period, this is a finding.
AAA Services must be configured to maintain locks on user accounts until released by an administrator.
Discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
Fix Text
Configure AAA Services to maintain locks on user accounts until released by an administrator.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to maintain locks on user accounts until released by an administrator. If AAA Services are not configured to maintain locks on user accounts until released by an administrator, this is a finding.
AAA Services configuration audit records must identify what type of events occurred.
Discussion
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit record content that may be necessary to satisfy the requirement of this policy includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.
Fix Text
Configure AAA Services audit records to identify what type of events occurred.
Check Content
Verify AAA Services configuration audit records identify what type of events occurred. If AAA Services configuration audit records do not identify what type of events occurred, this is a finding.
AAA Services configuration audit records must identify when (date and time) the events occurred.
Discussion
Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. In order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know when events occurred (date and time). Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.
Fix Text
Configure AAA Services audit records to identify when the events occurred by specifying the date and time.
Check Content
Verify AAA Services configuration audit records identify the date and time events occurred. If AAA Services configuration audit records do not identify when the events occurred, this is a finding.
AAA Services configuration audit records must identify where the events occurred.
Discussion
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. In order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as application components, modules, session identifiers, filenames, host names, and functionality. Associating information about where the event occurred within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.
Fix Text
Configure AAA Services audit records to identify where the events occurred.
Check Content
Verify AAA Services configuration audit records identify where the events occurred. If AAA Services configuration audit records do not identify where the events occurred, this is a finding.
AAA Services configuration audit records must identify the source of the events.
Discussion
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In addition to logging where events occur within the application, the application must also produce audit records that identify the application itself as the source of the event. In the case of centralized logging, the source would be the application name accompanied by the host or client name. In order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know the source of the event, particularly in the case of centralized logging. Associating information about the source of the event within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.
Fix Text
Configure AAA Services configuration audit records to identify the source of the events.
Check Content
Verify AAA Services configuration audit records identify the source of the events. If AAA Services configuration audit records do not identify the source of the events, this is a finding.
AAA Services configuration audit records must identify the outcome of the events.
Discussion
Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the system. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.
Fix Text
Configure AAA Services configuration audit records to identify the outcome of the events.
Check Content
Verify AAA Services configuration audit records identify the outcome of the events. If AAA Services configuration audit records do not identify the outcome of the events, this is a finding.
AAA Services configuration audit records must identify any individual user or process associated with the event.
Discussion
Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event. Event identifiers (if authenticated or otherwise known) include, but are not limited to, user database tables, primary key values, user names, or process identifiers.
Fix Text
Configure AAA Services configuration audit records to identify any individual user associated with the event. When events are caused by a system process rather than an individual user, that process must be identified in the audit record.
Check Content
Verify AAA Services configuration audit records identify any individual user associated with the event. When a system process rather than an individual user causes the event, the process must be identified in the audit record. If AAA Services configuration audit records do not identify any individual user or process associated with the event, this is a finding.
AAA Services must be configured to send audit records to a centralized audit server.
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Fix Text
Configure AAA Services to send audit records to a centralized audit server.
Check Content
Verify AAA Services are configured to send audit records to a centralized audit server. If AAA Services are not configured to send audit records to a centralized audit server, this is a finding.
AAA Services must be configured to alert the SA and ISSO when any audit processing failure occurs.
Discussion
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.
Fix Text
Configure AAA Services to alert the SA and ISSO when any audit processing failure occurs.
Check Content
Verify AAA Services are configured to alert the SA and ISSO when any audit processing failure occurs. If AAA Services are not configured to alert the SA and ISSO when any audit processing failure occurs, this is a finding.
AAA Services must be configured to generate audit records overwriting the oldest audit records in a first-in-first-out manner.
Discussion
It is critical that when AAA Services are at risk of failing to process audit logs as required, they take action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. For AAA Services, availability is an overriding concern, and so both of the following approved actions in response to an audit failure must be met: (i) If the failure was caused by the lack of audit record storage capacity, AAA Services must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. (ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, AAA Services must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server.
Fix Text
Configure AAA Services to generate audit records overwriting the oldest audit records in a first-in-first-out manner. Some specific implementations may further require automatically restarting the audit service to synchronize the local audit data with the collection server. The configuration must continue generating audit records, even when failures are caused by the lack of audit record storage capacity.
Check Content
Verify AAA Services are configured to generate audit records overwriting the oldest audit records in a first-in-first-out manner. When failures are caused by the lack of audit record storage capacity, AAA Services must continue generating audit records. If AAA Services are not configured to generate audit records overwriting the oldest audit records in a first-in-first-out manner, this is a finding.
AAA Services must be configured to queue audit records locally until communication is restored when any audit processing failure occurs.
Discussion
It is critical that when AAA Services are at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. For AAA Services, availability is an overriding concern, and so both of the following approved actions in response to an audit failure must be met: (i) If the failure was caused by the lack of audit record storage capacity, AAA Services must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. (ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, AAA Services must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server.
Fix Text
Configure AAA Services to queue audit records locally until communication is restored when any audit processing failure occurs. Some specific implementations may further require automatically restarting the audit service to synchronize the local audit data with the collection server. In some cases, AAA Services may require the audit records to be retrieved manually in the event of audit failure.
Check Content
Verify AAA Services are configured to queue audit records locally when any audit processing failure occurs. The queuing must continue until communication is restored or until the audit records are retrieved manually. Some specific implementations may further require automatically restarting the audit service to synchronize the local audit data with the collection server. If AAA Services are not configured to queue audit records locally until communication is restored when any audit processing failure occurs, this is a finding.
AAA Services must be configured to use internal system clocks to generate time stamps for audit records.
Discussion
Without an internal clock used as the reference for the time stored on each event to provide a trusted common reference for the time, forensic analysis would be impeded. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. If the internal clock is not used, the system may not be able to provide time stamps for log messages. Additionally, externally generated time stamps may not be accurate. Applications can use the capability of an operating system or purpose-built module for this purpose. Synchronizing the internal clock using NTP provides uniformity for all system clocks over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.
Fix Text
Configure AAA Services to use internal system clocks to generate time stamps for audit records.
Check Content
Verify AAA Services are configured to use internal system clocks to generate time stamps for audit records. If AAA Services are not configured to use internal system clocks to generate time stamps for audit records, this is a finding.
AAA Services must be configured with a minimum granularity of one second to record time stamps for audit records.
Discussion
Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records. Time stamps generated by the application include date and time. Granularity of time measurements refers to the degree of synchronization between information system clocks and reference clocks.
Fix Text
Configure AAA Services with a minimum granularity of one second to record time stamps for audit records.
Check Content
Verify AAA Services are configured with a minimum granularity of one second to record time stamps for audit records. If AAA Services are not configured with a minimum granularity of one second to record time stamps for audit records, this is a finding.
AAA Services must be configured to use or map to Coordinated Universal Time (UTC) to record time stamps for audit records.
Discussion
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by the application include date and time. Time is commonly expressed in Coordinated Universal Time (UTC) or local time with an offset from UTC.
Fix Text
Configure AAA Services to use or map to UTC to record time stamps for audit records.
Check Content
Verify AAA Services are configured to use or map to UTC to record time stamps for audit records. The audit records must either show UTC time or an offset to UTC time for each entry. If AAA Services are not configured to use or map to UTC to record time stamps for audit records, this is a finding.
AAA Services must be configured to use at least two NTP servers to synchronize time.
Discussion
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. If the internal clock is not used, the system may not be able to provide time stamps for log messages. Additionally, externally generated time stamps may not be accurate. Applications can use the capability of an operating system or purpose-built module for this purpose. Synchronizing the internal clock using NTP provides uniformity for all system clocks over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source.
Fix Text
Configure AAA Services to use two separate NTP servers. Both a primary and backup NTP server must be identified in the configuration.
Check Content
Verify AAA Services are configured to use at least two NTP servers to synchronize time. Both a primary and backup NTP server must be identified in the configuration. AAA Services may leverage the capability of an operating system. If AAA Services are not configured to use at least two separate NTP servers, this is a finding.
AAA Services must be configured to authenticate all NTP messages received from NTP servers and peers.
Discussion
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source. NTP may pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.
Fix Text
Configure AAA Services to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm. When AAA Services are not capable of using FIPS-approved message authentication code algorithms, configure AAA Services to use MD5 message authentication code algorithms.
Check Content
Verify AAA Services are configured to authenticate all NTP messages received from NTP servers and peers. The NTP server or peer authentication must use a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. AAA Services may leverage the capability of an operating system. If AAA Services are not configured to authenticate all NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. If AAA Services are not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, but are configured to use an MD5 for NTP message authentication, this is downgraded to a CAT III.
AAA Services must be configured to use their loopback or OOB management interface address as the source address when originating NTP traffic.
Discussion
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate. Additionally, unnecessary synchronization may have an adverse impact on system performance and may indicate malicious activity. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. NTP provides an efficient and scalable method for network devices to synchronize to an accurate time source. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router's loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address.
Fix Text
Configure AAA Services to use their loopback or OOB management interface address as the source address when originating NTP traffic.
Check Content
Verify AAA Services are configured to use their loopback interface address as the source address when originating NTP traffic. When AAA Services are managed from an OOB management network, the OOB interface must be used instead of the loopback address for originating NTP traffic. If AAA Services are not configured to use the OOB interface when managed from an OOB management network, this is a finding. If AAA Services are not configured to use the loopback or OOB management interface as the source address when originating NTP traffic, this is a finding.
AAA Services must be configured to audit each authentication and authorization transaction.
Discussion
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoD has defined the list of events for which the application will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions.
Fix Text
Configure AAA Services to audit each authentication and authorization transaction.
Check Content
Verify AAA Services are configured to audit each authentication and authorization transaction. If AAA Services are not configured to audit each authentication and authorization transaction, this is a finding.
AAA Services must be configured to uniquely identify and authenticate organizational users.
Discussion
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following. (i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.
Fix Text
Configure AAA Services to uniquely identify and authenticate organizational users.
Check Content
Verify AAA Services are configured to uniquely identify and authenticate organizational users. For STIGs produced from this requirement, when AAA Services are used to authenticate processes acting on behalf of organizational users, they also must be uniquely identified and authenticated. If AAA Services are not configured to uniquely identify and authenticate organizational users, this is a finding.
AAA Services must be configured to require multifactor authentication using Personal Identity Verification (PIV) credentials for authenticating privileged user accounts.
Discussion
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).
Fix Text
Configure AAA Services to require multifactor authentication using PIV credentials for authenticating privileged user accounts. Although the CAC is a PIV credential, it should not be used for privileged accounts, but rather only for non-privileged accounts.
Check Content
Verify AAA Services are configured to require multifactor authentication using PIV credentials for authenticating privileged user accounts. Although the Common Access Card (CAC) is a PIV credential, it should not be used for privileged accounts, but rather only for non-privileged accounts. Administrative smart cards and tokens, separate from the CAC, are the preferred solution for privileged accounts. If AAA Services are not configured to require multifactor authentication using PIV credentials for authenticating privileged user accounts, this is a finding.
AAA Services must be configured to require multifactor authentication using Common Access Card (CAC) Personal Identity Verification (PIV) credentials for authenticating non-privileged user accounts.
Discussion
To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A non-privileged account is any information system account with authorizations of a non-privileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection. Applications integrating with the DoD Active Directory and using the DoD CAC are examples of compliant multifactor authentication solutions.
Fix Text
Configure AAA Services to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts.
Check Content
Verify AAA Services are configured to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts. If AAA Services are not configured to require multifactor authentication using CAC PIV credentials for authenticating non-privileged user accounts, this is a finding.
AAA Services used for 802.1x must be configured to uniquely identify network endpoints (supplicants) before the authenticator establishes any connection.
Discussion
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions. This requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to workstations, printers, servers [outside a datacenter], VoIP phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.
Fix Text
Configure AAA Services for 802.1x identification and authentication to uniquely identify supplicants before the authenticator establishes any connection.
Check Content
If AAA Services are not used for 802.1x endpoint identification and authentication, this is not applicable. Verify AAA Services are configured to uniquely identify supplicants before the authenticator establishes any connection. If AAA Services are not configured to uniquely identify supplicants before the authenticator establishes any connection, this is a finding.
AAA Services used for 802.1x must be configured to authenticate network endpoint devices (supplicants) before the authenticator establishes any connection.
Discussion
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions. This requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to workstations, printers, servers [outside a datacenter], VoIP phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.
Fix Text
Configure AAA Services to authenticate supplicants before the authenticator establishes any connection.
Check Content
If AAA Services are not used for 802.1x endpoint identification and authentication, this is not applicable. Verify AAA Services are configured to authenticate supplicants before the authenticator establishes any connection. If AAA Services are not configured to authenticate supplicants before the authenticator establishes any connection, this is a finding.
AAA Services used for 802.1x must be configured to use secure Extensible Authentication Protocol (EAP), such as EAP-TLS, EAP-TTLS, and PEAP.
Discussion
Additional new EAP methods/types are still being proposed. However, the three being considered secure are EAP-TLS, EAP-TTLS, and PEAP. PEAP is the preferred EAP type to be used in DoD for its ability to support a greater number of operating systems and its capability to transmit statement of health information, per NSA NAC study. Lightweight EAP (LEAP) is a CISCO proprietary protocol providing an easy-to-deploy one-password authentication. LEAP is vulnerable to dictionary attacks. A "man in the middle" can capture traffic, identify a password, and then use it to access a WLAN. LEAP is inappropriate and does not provide sufficient security for use on DOD networks. EAP-MD5 is functionally similar to CHAP and is susceptible to eavesdropping because the password credentials are sent as a hash (not encrypted). In addition, server administrators would be required to store unencrypted passwords on their servers violating other security policies. EAP-MD5 is inappropriate and does not provide sufficient security for use on DOD networks.
Fix Text
Configure AAA Services used for 802.1x to use secure EAP, such as EAP-TLS, EAP-TTLS, and PEAP.
Check Content
Verify AAA Services used for 802.1x are configured to use secure EAP. Currently acceptable secure protocols are EAP-TLS, EAP-TTLS, and PEAP. If AAA Services used for 802.1x are not configured to use secure EAP, this is a finding.
AAA Services must be configured to enforce a minimum 15-character password length.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.
Fix Text
Configure AAA Services to enforce a minimum 15-character password length. This includes randomly assigned passwords, shared secrets, and pre-shared keys.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce a minimum 15-character password length. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to enforce a minimum 15-character password length, this is a finding.
AAA Services must be configured to enforce password complexity by requiring that at least one upper-case character be used.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix Text
Configure AAA Services to enforce password complexity by requiring that at least one upper-case character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one upper-case character be used. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to require that at least one upper-case character be used, this is a finding.
AAA Services must be configured to enforce password complexity by requiring that at least one lower-case character be used.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix Text
Configure AAA Services to enforce password complexity by requiring that at least one lower-case character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one lower-case character be used. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to require that at least one lower-case character be used, this is a finding.
AAA Services must be configured to enforce password complexity by requiring that at least one numeric character be used.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix Text
Configure AAA Services to enforce password complexity by requiring that at least one numeric character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one numeric character be used. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to require that at least one numeric character be used, this is a finding.
AAA Services must be configured to enforce password complexity by requiring that at least one special character be used.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Special characters are those characters that are not alphanumeric. Examples include: ~ ! @ # $ % ^ *.
Fix Text
Configure AAA Services to enforce password complexity by requiring that at least one special character be used. This includes randomly assigned passwords, shared secrets, and pre-shared keys.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords (to include randomly assigned passwords, shared secrets, and pre-shared keys) are used, verify AAA Services are configured to enforce password complexity by requiring that at least one special character be used. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to require that at least one special character be used, this is a finding.
AAA Services must be configured to require the change of at least eight of the total number of characters when passwords are changed.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Use of a complex password helps to increase the time and resources required to compromise the password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.
Fix Text
Configure AAA Services to require the change of at least eight of the total number of characters when passwords are changed. Note: The best practice would be to require that all characters must be changed with each password change, especially for privileged accounts.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Where passwords are used, verify AAA Services are configured to require the change of at least eight of the total number of characters when passwords are changed. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to require the change of at least eight of the total number of characters when passwords are changed, this is a finding.
AAA Services must be configured to encrypt transmitted credentials using a FIPS-validated cryptographic module.
Discussion
Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. AAA Services can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.
Fix Text
Configure AAA Services to encrypt transmitted credentials using a FIPS-validated cryptographic module.
Check Content
Where passwords are used, verify AAA Services are configured to encrypt transmitted credentials using a FIPS-validated cryptographic module. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose. If AAA Services are not configured to encrypt transmitted credentials using a FIPS-validated cryptographic module, this is a finding. Note: FIPS-validated cryptographic modules are listed on the NIST Cryptographic Module Validation Program's (CMVP) validation list.
AAA Services must be configured to enforce 24 hours as the minimum password lifetime.
Discussion
Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. Restricting this setting limits the user's ability to change their password. Passwords need to be changed at specific policy based intervals; however, if the application allows the user to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
Fix Text
Configure AAA Services to enforce 24 hours as the minimum password lifetime. When the AAA Services configuration setting is for "1 day", it is required that the length be 24 hours. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort. Where passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to enforce 24 hours as the minimum password lifetime. When the AAA Services configuration setting is for "1 day", it is required that the length be 24 hours. If AAA Services are not configured to enforce 24 hours as the minimum password lifetime, this is a finding.
AAA Services must be configured to enforce a 60-day maximum password lifetime restriction.
Discussion
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts that are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.
Fix Text
Configure AAA Services to enforce a 60-day maximum password lifetime restriction. Additionally, configure AAA Services to force password change upon the first logon after the expiration of the 60 days. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort. Where passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to enforce a 60-day maximum password lifetime restriction. Additionally, AAA Services must force password change upon the first logon after the expiration of the 60 days. If AAA Services are not configured to enforce a 60-day maximum password lifetime restriction, this is a finding.
AAA Services must be configured to prohibit password reuse for a minimum of five generations.
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.
Fix Text
Configure AAA Services to prohibit password reuse for a minimum of five generations. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort. Where passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to prohibit password reuse for a minimum of five generations. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to prohibit password reuse for a minimum of five generations, this is a finding.
AAA Services must be configured to allow the use of a temporary password at initial logon with an immediate change to a permanent password.
Discussion
Without providing this capability, an account may be created without a password. Non-repudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon. Temporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts that allow the users to log on, yet force them to change the password once they have successfully authenticated.
Fix Text
Configure AAA Services to allow the use of a temporary password at initial logon with an immediate change to a permanent password. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort. Where passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to allow the use of a temporary password at initial logon with an immediate change to a permanent password. This requirement may be verified by demonstration or configuration review. If AAA Services are not configured to allow the use of a temporary password at initial logon with an immediate change to a permanent password, this is a finding.
AAA Services must be configured to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication.
Discussion
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. This requirement verifies that a certification path to an accepted trust anchor is used to for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses.
Fix Text
Configure AAA Services to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication.
Check Content
Verify AAA Services are configured to only accept certificates issued by a DoD-approved Certificate Authority for PKI-based authentication. If AAA Services are not configured to only accept certificates issued by a DoD-approved Certificate Authority, this is a finding.
AAA Services must be configured to not accept certificates that have been revoked for PKI-based authentication.
Discussion
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. This requirement verifies that a certification path to an accepted trust anchor is used to for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses.
Fix Text
Configure AAA Services to not accept certificates that have been revoked for PKI-based authentication.
Check Content
Verify AAA Services are configured to reflect certificates that have been revoked for PKI-based authentication. If AAA Services are not configured to reject certificates that have been revoked, this is a finding.
AAA Services must be configured to enforce authorized access to the corresponding private key for PKI-based authentication.
Discussion
If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
Fix Text
Configure AAA Services to enforce authorized access to the corresponding private key for PKI-based authentication.
Check Content
Verify AAA Services are configured to enforce authorized access to the corresponding private key for PKI-based authentication. If AAA Services are not configured to enforce authorized access to the corresponding private key, this is a finding.
AAA Services must be configured to map the authenticated identity to the user account for PKI-based authentication.
Discussion
Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.
Fix Text
Configure AAA Services to map the authenticated identity to the user account for PKI-based authentication.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to map the authenticated identity to the user account for PKI-based authentication. If AAA Services are not configured to map the authenticated identity to the user account, this is a finding.
AAA Services must be configured to protect the confidentiality and integrity of all information at rest.
Discussion
Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive) within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of their data storage (e.g., hard drives and non-volatile memory) can be read, copied, or altered. Applications and application users generate information throughout the course of their application use. This requirement addresses protection of user-generated data, as well as, operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information.
Fix Text
Configure AAA Services to protect the confidentiality and integrity of all information at rest. AAA Services may leverage the capability of an operating system or require the use of a purpose-built module for this purpose. Potential locations include the local file system where configurations and events are stored or in a related database table.
Check Content
Verify AAA Services are configured to protect the confidentiality and integrity of all information at rest. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose. Potential locations include the local file system where configurations and events are stored or in a related database table. If AAA Services are not configured to protect the confidentiality and integrity of all information at rest, this is a finding.
AAA Services must not be configured with shared accounts.
Discussion
Shared accounts configured for use on a network device do not allow for accountability or repudiation of individuals using them. If shared accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having shared accounts does not allow for proper auditing of who is accessing or changing the network. For this reason, shared accounts are not permitted.
Fix Text
Configure AAA Services with no shared accounts. Remove all group profiles.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are not configured with shared accounts. Identify group profile definitions that do not meet the accounts user-id naming convention. Below is a super-user example of how an SA profile may be associated. Group Profile Information group = super-user{ profile_id = 40 profile_cycle = 1 service=shell { default cmd=permit cmd=debug { deny all permit .* } } } Below is an example of the user definition that should be assigned with a valid ID (not rtr-geek). Look for group accounts here: user = rtr-geek{ profile_id = 45 profile_cycle = 1 member = rtr_super password = des "********" } If AAA Services are configured with shared accounts (group profiles), this is a finding.
AAA Services used to authenticate privileged users for device management must be configured to connect to the management network.
Discussion
Using standardized authentication protocols such as RADIUS, TACACS+, and Kerberos, an authentication server provides centralized and robust authentication services for the management of network components. In order to control access to the servers as well as monitor traffic to them, the authentication servers should only be connected to the management network.
Fix Text
Configure AAA Services used to authenticate privileged users for device management to connect to the management network.
Check Content
If AAA Services are not used for authentication of privileged users to AAA Services, this is not applicable. Verify AAA Services are configured to connect to the management network. Confirm AAA Services are not dual-homed by physically inspecting the physical LAN connection. If AAA Services are configured to connect to a non-management network, this is a finding.
AAA Services must be configured to use a unique shared secret for communication (i.e. RADIUS, TACACS+) with clients requesting authentication services.
Discussion
Using standardized authentication protocols such as RADIUS, TACACS+, and Kerberos, an authentication server provides centralized and robust authentication services for the management of network components. An authentication server is very scalable as it supports many user accounts and authentication sessions with the network components.
Fix Text
Configure AAA Services to use a unique shared secret for communication (i.e. RADIUS, TACACS+) with all clients requesting authentication services.
Check Content
If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable. Verify AAA Services are configured to use a unique shared secret with clients requesting authentication services. The shared secret is to be the same for communication between AAA Services and the client devices. All shared secrets must meet password complexity requirements. If AAA Services are not configured to use a unique shared secret for communication with clients requesting authentication services, this is a finding.
AAA Services must be configured to use IP segments separate from production VLAN IP segments.
Discussion
When policy assessment and remediation have been implemented and the advanced AAA server dynamic VLAN is misconfigured, logical separation of the production VLAN may not be assured. Non-trusted resources are resources that are not authenticated in a NAC solution implementing only the authentication component of NAC. Non-trusted resources could become resources that have been authenticated but have not had a successful policy assessment when the automated policy assessment component has been implemented.
Fix Text
Configure AAA Services to use IP segments separate from production VLAN IP segments.
Check Content
If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable. Verify AAA Services are configured to use IP segments separate from production VLAN IP segments. If AAA Services are not configured to use IP segments separate from production VLAN IP segments, this is a finding.
AAA Services must be configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access.
Discussion
Devices having an IP address that do not pass authentication can be used to attack compliant devices if they share VLANs. When devices proceed into the NAC AAA (radius) functions they must originate in the Unauthorized VLAN by default. If the device fails authentication, it should be denied IP capability and movement to other dynamic VLANs used in the NAC process flow or moved to a VLAN that has limited capability such as a Guest VLAN with internet access, but without access to production assets.
Fix Text
Configure AAA Services to place non-authenticated network access requests in the Unauthorized VLAN without access to production data. Implement a NAC solution where the device remains without IP assignment if authentication fails or create a dynamic Unauthorized VLAN/Guest VLAN with limited access in AAA server. If a Guest VLAN is built, it should not have access to production data.
Check Content
If AAA Services are not used for 802.1x authentication or to authenticate privileged users for device management, this is not applicable. Verify AAA Services are configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access. If the SA has created a dynamic Unauthorized VLAN, definitions should not have an IP pool assignment. Ensure the Unauthorized VLAN is configured without IP or a Guest VLAN is defined with limited access. If AAA Services are not configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access, this is a finding.
AAA Services must be configured to disable non-essential modules.
Discussion
It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.
Fix Text
Configure AAA Services to disable non-essential modules.
Check Content
Determine if AAA Services are configured to disable non-essential modules. If AAA Services are not configured to disable non-essential modules, this is a finding.
AAA Services must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
Discussion
In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services; however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.
Fix Text
Configure AAA Services to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
Check Content
Review the AAA Services configuration to ascertain if it prohibits or restricts the use of organization-defined functions, ports, protocols, and/or services. Further determine if the use is as defined in the PPSM CAL and vulnerability assessments. If AAA Services are not configured in accordance with the PPSM CAL and vulnerability assessments, this is a finding.
AAA Services must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Discussion
Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.
Fix Text
Configure the network device to be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Check Content
Determine if AAA Services are configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. If AAA Services are not configured in accordance with the designated security configuration settings, this is a finding.
AAA Services must be configured to automatically remove temporary user accounts after 72 hours.
Discussion
When temporary user accounts remain active after no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary user accounts must be set upon account creation. Disabling a temporary account provides a higher risk alternative; disabling allows an insider adversary to enable the privileged account and make it permanent. Temporary accounts, when used, mandate that AAA Services must be configured to automatically terminate these types of accounts after 72 hours. When AAA Services do not perform account management, the connected Active Directory must provide this setting.
Fix Text
Configure AAA Services to automatically remove temporary user accounts after 72 hours.
Check Content
If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically remove temporary user accounts after 72 hours. If the AAA Services configuration does not automatically remove temporary user accounts after 72 hours, this is a finding.
AAA Services must be configured to encrypt locally stored credentials using a FIPS-validated cryptographic module.
Discussion
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. AAA Services must enforce cryptographic representations of passwords when storing passwords in databases, configuration files, and log files. Passwords must be protected at all times; using a strong one-way hashing encryption algorithm with a salt is the standard method for providing a means to validate a password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security. If passwords are stored in clear text, they can be plainly read and easily compromised.
Fix Text
Configure AAA Services to encrypt locally stored credentials using a FIPS-validated cryptographic module. Configure all associated databases, configuration files, and audit files to use only encrypted representations for all passwords and so that no password strings are readable/discernable.
Check Content
Where passwords are used, verify AAA Services are configured to encrypt locally stored credentials using a FIPS-validated cryptographic module. AAA Services may leverage the capability of an operating system or purpose-built module for this purpose. Confirm that databases, configuration files, and log files have encrypted representations for all passwords, and that no password strings are readable/discernable. Potential locations include the local file system where configurations and events are stored, or in a related database table. Review AAA Services configuration for use of the MD5 algorithm to create password hashes. If AAA Services are not configured to encrypt locally stored credentials using a FIPS-validated cryptographic module, this is a finding. If AAA Services are configured to use MD5 to create password hashes, this is a finding. Note: FIPS-validated cryptographic modules are listed on the NIST Cryptographic Module Validation Program's (CMVP) validation list.