UCF STIG Viewer Logo

Cisco ISE NDM Security Technical Implementation Guide


Overview

Date Finding Count (56)
2021-09-27 CAT I (High): 9 CAT II (Med): 44 CAT III (Low): 3
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC II - Mission Support Public)

Finding ID Severity Title
V-242656 High The Cisco ISE must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
V-242657 High The Cisco ISE must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
V-242655 High The Cisco ISE must verify the checksum value of any software download, including install files (ISO or OVA), patch files, and upgrade bundles.
V-242651 High For accounts using password authentication, the Cisco ISE must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
V-242659 High The Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored.
V-242641 High The Cisco ISE must be configured to disable Wireless Setup for production systems.
V-242640 High The Cisco ISE must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
V-242653 High The Cisco ISE must use FIPS-validated SHA-2 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications.
V-242615 High The Cisco ISE must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
V-242634 Medium The Cisco ISE must be running an operating system release that is currently supported by the vendor.
V-242627 Medium The Cisco ISE must configure a remote syslog where audit records are stored on a centralized logging target that is different from the system being audited.
V-242636 Medium The Cisco ISE must generate log records for a locally developed list of auditable events.
V-242637 Medium The Cisco ISE must be configured to conduct backups of system level information contained in the information system when changes occur.
V-242630 Medium The Cisco ISE must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
V-242631 Medium The Cisco ISE must audit the enforcement actions used to restrict access associated with changes to the device.
V-242632 Medium The Cisco ISE must enforce access restrictions associated with changes to the firmware, OS, and hardware components.
V-242633 Medium The Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access.
V-242654 Medium The Cisco ISE must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.
V-242639 Medium The Cisco ISE must use DoD-approved PKI rather than proprietary or self-signed device certificates.
V-242650 Medium For accounts using password authentication, the Cisco ISE must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
V-242621 Medium The Cisco ISE must generate audit records when successful attempts to modify administrator privileges occur.
V-242624 Medium The Cisco ISE must generate audit records for privileged activities or other system-level access.
V-242623 Medium The Cisco ISE must generate audit records when successful logon attempts occur.
V-242622 Medium The Cisco ISE must generate audit records when successful attempts to delete administrator privileges occur.
V-242643 Medium The Cisco ISE must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
V-242658 Medium The Cisco ISE must generate unique session identifiers using a FIPS 140-2 approved Random Number Generator (RNG) using DRGB.
V-242626 Medium The Cisco ISE must limit audit record storage capacity for all locally stored logs.
V-242649 Medium For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one special character be used.
V-242609 Medium For the local web-based account of last resort, the Cisco ISE must automatically audit account creation.
V-242608 Medium The Cisco ISE must change the password for the local CLI and web-based account when members who have access to the password leave the role and are no longer authorized access.
V-242648 Medium For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one digit be used.
V-242652 Medium The Cisco ISE must prohibit the use of cached authenticators after an organization-defined time period.
V-242625 Medium The Cisco ISE must generate audit records when concurrent logons from different workstations occur.
V-242642 Medium For accounts using password authentication, the Cisco ISE must implement replay-resistant authentication mechanisms for network access to privileged accounts.
V-242645 Medium For accounts using password authentication, the Cisco ISE must enforce a minimum 15-character password length.
V-242644 Medium The Cisco ISE must authenticate Network Time Protocol sources using authentication that is cryptographically based.
V-242647 Medium For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one lower-case character be used.
V-242646 Medium For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one upper-case character be used.
V-242663 Medium The Cisco ISE must generate audit records containing the full-text recording of privileged commands.
V-242662 Medium The Cisco ISE must initiate session auditing upon startup.
V-242661 Medium The Cisco ISE must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.
V-242660 Medium The Cisco ISE must configure the control plane to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself by configuring applicable system options and internet-options.
V-242629 Medium The Cisco ISE must be configured to synchronize internal information system clocks using redundant authoritative time sources.
V-242628 Medium The Cisco ISE must send an alarm to one or more individuals when the monitoring collector process has an error or failure.
V-242620 Medium The Cisco ISE must generate audit records when successful attempts to access privileges occur.
V-242618 Medium For the local account of last resort, the Cisco ISE must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
V-242619 Medium The Cisco ISE must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
V-242612 Medium For the local account of last resort, the Cisco ISE must automatically audit account removal actions.
V-242610 Medium For the local web-based account of last resort and the default local CLI account, the Cisco ISE must automatically audit account modification.
V-242611 Medium For the local web-based account of last resort, the Cisco ISE must automatically audit account disabling actions.
V-242616 Medium The Cisco ISE must audit the execution of privileged functions.
V-242617 Medium The Cisco ISE must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.
V-242614 Medium The Cisco ISE must be configured with only one local web-based account to be used as the account of last resort in the event the authentication server is unavailable.
V-242638 Low The Cisco ISE must conduct backups of information system documentation, including security-related configuration files when changes occur or weekly, whichever is sooner.
V-242607 Low For the account of last resort, the Cisco ISE must limit the number of concurrent sessions to one.
V-242613 Low The Cisco ISE must automatically audit account enabling actions.