UCF STIG Viewer Logo

The BIG-IP appliance must be configured to prohibit password reuse for a minimum of five generations.


Overview

Finding ID Version Rule ID IA Controls Severity
V-228989 F5BI-DM-000109 SV-228989r557520_rule Medium
Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.
STIG Date
F5 BIG-IP Device Management 11.x Security Technical Implementation Guide 2020-09-28

Details

Check Text ( C-31304r518012_chk )
Verify the BIG-IP appliance is configured to use a properly configured authentication server that prohibits password reuse for a minimum of five generations.

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify "Authentication: User Directory" is configured for an approved remote authentication server that prohibits password reuse for a minimum of five generations.

If the BIG-IP appliance is not configured to use an associated authentication server that prohibits password reuse for a minimum of five generations, this is a finding.
Fix Text (F-31281r518013_fix)
Configure the BIG-IP appliance to use a properly configured authentication server to prohibit password reuse for a minimum of five generations.