The firewall implementation must be configured to dynamically manage account privileges and associated access authorizations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000014-FW-000014	SRG-NET-000014-FW-000014	SRG-NET-000014-FW-000014_rule		Medium

Description
Dynamic privilege management includes immediate revocation of privileges (not requiring users to terminate and restart the session to reflect changes in privileges). Dynamic privilege management also refers to mechanisms that change the privileges of users based on dynamic rules rather than the editing of specific user profiles. Other mechanisms include making automatic adjustments to privileges if accounts are operating out of normal work times, if information systems are under duress, or in emergency maintenance situations. If the firewall implementation is not configured to dynamically manage account privileges and associated access authorizations to meet security policies, then changes in account privileges or command authorizations may not immediately take effect and unauthorized entities may gain access to the information.

Description

Dynamic privilege management includes immediate revocation of privileges (not requiring users to terminate and restart the session to reflect changes in privileges). Dynamic privilege management also refers to mechanisms that change the privileges of users based on dynamic rules rather than the editing of specific user profiles. Other mechanisms include making automatic adjustments to privileges if accounts are operating out of normal work times, if information systems are under duress, or in emergency maintenance situations. If the firewall implementation is not configured to dynamically manage account privileges and associated access authorizations to meet security policies, then changes in account privileges or command authorizations may not immediately take effect and unauthorized entities may gain access to the information.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000014-FW-000014_chk )
Verify changes to account privileges and authorizations to execute firewall commands are based on dynamic rules or automated adjustments to changes in operating conditions. Verify privileges and command authorizations are immediately revoked when changed (not requiring users to terminate and restart the session to reflect changes in privileges). If changes to account privileges are not dynamically updated, this is a finding.

Check Text ( C-SRG-NET-000014-FW-000014_chk )

Verify changes to account privileges and authorizations to execute firewall commands are based on dynamic rules or automated adjustments to changes in operating conditions.
Verify privileges and command authorizations are immediately revoked when changed (not requiring users to terminate and restart the session to reflect changes in privileges).

If changes to account privileges are not dynamically updated, this is a finding.

Fix Text (F-SRG-NET-000014-FW-000014_fix)
Configure the firewall implementation to use dynamic privilege management mechanisms to dynamically manage account privileges and associated access authorizations.