The BIG-IP appliance must be configured to prohibit password reuse for a minimum of five generations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228989	F5BI-DM-000109	SV-228989r879887_rule		Medium

Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

Description

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

STIG	Date
F5 BIG-IP Device Management Security Technical Implementation Guide	2024-01-26

Details

Check Text ( C-31304r518012_chk )
Verify the BIG-IP appliance is configured to use a properly configured authentication server that prohibits password reuse for a minimum of five generations. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify "Authentication: User Directory" is configured for an approved remote authentication server that prohibits password reuse for a minimum of five generations. If the BIG-IP appliance is not configured to use an associated authentication server that prohibits password reuse for a minimum of five generations, this is a finding.

Check Text ( C-31304r518012_chk )

Verify the BIG-IP appliance is configured to use a properly configured authentication server that prohibits password reuse for a minimum of five generations.

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify "Authentication: User Directory" is configured for an approved remote authentication server that prohibits password reuse for a minimum of five generations.

If the BIG-IP appliance is not configured to use an associated authentication server that prohibits password reuse for a minimum of five generations, this is a finding.

Fix Text (F-31281r518013_fix)
Configure the BIG-IP appliance to use a properly configured authentication server to prohibit password reuse for a minimum of five generations.