The BIG-IP appliance must be configured to notify the administrator of the number of successful logon attempts occurring during an organization-defined time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-229009	F5BI-DM-000261	SV-229009r557520_rule		Low

Description
Administrators need to be aware of activity that occurs regarding their network device management account. Providing administrators with information regarding the date and time of their last successful logon allows the administrator to determine if any unauthorized activity has occurred. This incorporates all methods of logon, including, but not limited to, SSH, HTTP, HTTPS, and physical connectivity. The organization-defined time period is dependent on the frequency with which administrators typically log on to the network device.

Description

Administrators need to be aware of activity that occurs regarding their network device management account. Providing administrators with information regarding the date and time of their last successful logon allows the administrator to determine if any unauthorized activity has occurred. This incorporates all methods of logon, including, but not limited to, SSH, HTTP, HTTPS, and physical connectivity. The organization-defined time period is dependent on the frequency with which administrators typically log on to the network device.

STIG	Date
F5 BIG-IP Device Management 11.x Security Technical Implementation Guide	2020-09-28

Details

Check Text ( C-31324r518071_chk )
Verify the BIG-IP appliance is configured to use a properly configured authentication server that notifies the administrator of the number of successful logon attempts occurring during an organization-defined time period. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify that "User Directory" is set to an approved authentication server type that notifies the administrator of the number of successful logon attempts occurring during an organization-defined time period. If the BIG-IP appliance is not configured to use a properly configured authentication server to notify the administrator of the number of successful logon attempts occurring during an organization-defined time period, this is a finding.

Check Text ( C-31324r518071_chk )

Verify the BIG-IP appliance is configured to use a properly configured authentication server that notifies the administrator of the number of successful logon attempts occurring during an organization-defined time period.

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify that "User Directory" is set to an approved authentication server type that notifies the administrator of the number of successful logon attempts occurring during an organization-defined time period.

If the BIG-IP appliance is not configured to use a properly configured authentication server to notify the administrator of the number of successful logon attempts occurring during an organization-defined time period, this is a finding.

Fix Text (F-31301r518072_fix)
Configure the BIG-IP appliance to use a properly configured authentication server to notify the administrator of the number of successful logon attempts occurring during an organization-defined time period.