The firewall implementation must automatically disable inactive accounts after an organizationally defined time period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37038	SRG-NET-000004-FW-000004	SV-48799r1_rule		Low

Description
Since the accounts in the firewall are privileged or system level accounts, account management is vital to the security of the firewall. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the firewall. This control does not include emergency administration accounts which are meant for access to the firewall components in case of network failure. This requirement is applicable to accounts created or managed using the firewall application. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Since the accounts in the firewall are privileged or system level accounts, account management is vital to the security of the firewall. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the firewall. This control does not include emergency administration accounts which are meant for access to the firewall components in case of network failure. This requirement is applicable to accounts created or managed using the firewall application. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45331r1_chk )
Review the account settings to determine if the firewall automatically disables inactive accounts after an organizationally defined time period. If the ability to disable inactive accounts is not automated or utilized, this is a finding.

Fix Text (F-41897r1_fix)
Configure the firewall implementation to automatically disable inactive accounts after an organizationally defined time period of inactivity.