The network element must audit the use of privileged accounts when accessing configuration and operational commands enabled for non-privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000035-FW-NA	SRG-NET-000035-FW-NA	SRG-NET-000035-FW-NA_rule		Medium

Description
The concept of least privilege is applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Accounts used to perform security-related functions must not be used to perform non-privileged functions on the firewall. Processes that support security functions are especially critical to secure with granular or fine-grained privileges. These processes include mechanisms involved with configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Auditing the use of accounts for non-privileged security functions is not a firewall function.

Description

The concept of least privilege is applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Accounts used to perform security-related functions must not be used to perform non-privileged functions on the firewall. Processes that support security functions are especially critical to secure with granular or fine-grained privileges. These processes include mechanisms involved with configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Auditing the use of accounts for non-privileged security functions is not a firewall function.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000035-FW-NA_chk )
This requirement is NA for firewall. No fix required.

Fix Text (F-SRG-NET-000035-FW-NA_fix)
This requirement is NA for firewall. No fix required.