The firewall implementation must limit privileges to change software resident within software libraries, including privileged programs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000123-FW-000078	SRG-NET-000123-FW-000078	SRG-NET-000123-FW-000078_rule		Medium

Description
Changes to any software components of the firewall can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the firewall for implementing any changes or upgrades. If the firewall were to enable non-authorized users to make changes to software libraries, those changes could be implemented without undergoing testing, validation, and approval. This requirement is not applicable if the underlying OS provides safeguards and countermeasures for the firewall software components.

Description

Changes to any software components of the firewall can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the firewall for implementing any changes or upgrades. If the firewall were to enable non-authorized users to make changes to software libraries, those changes could be implemented without undergoing testing, validation, and approval. This requirement is not applicable if the underlying OS provides safeguards and countermeasures for the firewall software components.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000123-FW-000078_chk )
Verify only qualified and authorized individuals have administrative access to the firewall for implementing any changes or upgrades. If individuals other than the authorized system administrators are allowed to upgrade or change the software, including ACLs or policy filters, this is a finding.

Fix Text (F-SRG-NET-000123-FW-000078_fix)
Configure a system administrators group with software update and modification privileges. Configure the firewall implementation so only members of this group have permission to perform these function.