The firewall implementation must automatically terminate temporary accounts after an organizationally defined time period for each type of account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000002-FW-000002	SRG-NET-000002-FW-000002	SRG-NET-000002-FW-000002_rule		Medium

Description
Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the firewall since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. This requirement is applicable to temporary accounts created or managed using the firewall application itself rather than the underlying OS or an authentication server. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the firewall since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. This requirement is applicable to temporary accounts created or managed using the firewall application itself rather than the underlying OS or an authentication server. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000002-FW-000002_chk )
If the site's security plan does not permit the use of temporary accounts for access to the firewall, this is not a finding. Review the firewall to ensure accounts can be configured to automatically terminate specified user accounts. If the firewall components do not automatically terminate temporary accounts after an organizationally defined time period, based on the type of account, this is a finding.

Check Text ( C-SRG-NET-000002-FW-000002_chk )

If the site's security plan does not permit the use of temporary accounts for access to the firewall, this is not a finding.

Review the firewall to ensure accounts can be configured to automatically terminate specified user accounts.

If the firewall components do not automatically terminate temporary accounts after an organizationally defined time period, based on the type of account, this is a finding.

Fix Text (F-SRG-NET-000002-FW-000002_fix)
Configure the firewall implementation to automatically terminate temporary accounts after an organizationally defined time period, based on the type of account. An acceptable method would be to place an expiration date on the account upon creation.