The firewall implementation must enforce the number of characters changed when passwords are changed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000159-FW-000098	SRG-NET-000159-FW-000098	SRG-NET-000159-FW-000098_rule		Low

Description
To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. Password strength is a measure of the effectiveness of a password in resisting guessing, dictionary attacks, and brute-force attacks. When users change the password, the system must ensure the new password is not too similar to the previously used password (s). This control applies to passwords configured or controlled by the firewall itself.

Description

To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. Password strength is a measure of the effectiveness of a password in resisting guessing, dictionary attacks, and brute-force attacks. When users change the password, the system must ensure the new password is not too similar to the previously used password (s). This control applies to passwords configured or controlled by the firewall itself.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000159-FW-000098_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the firewall application itself, this is not a finding. Verify an organizationally defined value is set for the number of characters that must be changed when passwords are changed. If an organizationally defined value is not set for the number of characters that must be different between the new password and the previously used password, this is a finding.

Check Text ( C-SRG-NET-000159-FW-000098_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the firewall application itself, this is not a finding.

Verify an organizationally defined value is set for the number of characters that must be changed when passwords are changed.

If an organizationally defined value is not set for the number of characters that must be different between the new password and the previously used password, this is a finding.

Fix Text (F-SRG-NET-000159-FW-000098_fix)
Set an organizationally defined value for the number of characters that must be different between the new password and the previously used password.