The BIG-IP appliance must be configured to prohibit password reuse for a minimum of five generations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-60149	F5BI-DM-000109	SV-74579r1_rule		Medium

Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

Description

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

STIG	Date
F5 BIG-IP Device Management 11.x Security Technical Implementation Guide	2019-12-20

Details

Check Text ( C-61003r1_chk )
Verify the BIG-IP appliance is configured to use a properly configured authentication server that prohibits password reuse for a minimum of five generations. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify "Authentication: User Directory" is configured for an approved remote authentication server that prohibits password reuse for a minimum of five generations. If the BIG-IP appliance is not configured to use an associated authentication server that prohibits password reuse for a minimum of five generations, this is a finding.

Check Text ( C-61003r1_chk )

Verify the BIG-IP appliance is configured to use a properly configured authentication server that prohibits password reuse for a minimum of five generations.

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify "Authentication: User Directory" is configured for an approved remote authentication server that prohibits password reuse for a minimum of five generations.

If the BIG-IP appliance is not configured to use an associated authentication server that prohibits password reuse for a minimum of five generations, this is a finding.

Fix Text (F-65737r1_fix)
Configure the BIG-IP appliance to use a properly configured authentication server to prohibit password reuse for a minimum of five generations.