| Enforcement of approved authorizations for access control allows granularity of privilege assignments for each administrator and ensures only authorized users have access to certain commands and functions on the firewall. A good best practice is to minimize the number of local accounts on network devices for use when the network is unavailable. The remaining administrator accounts are then defined and managed on the AAA server, which often has more robust account management functions. If management of authorizations and privileges are not enforced, it is difficult to track and manage user authorizations and privileges; and there is an increased risk of misconfiguration.
Authorizations for user accounts used to access network devices should be centralized to the AAA server even when the authorization is configured in the firewall application. If an authentication server is used, special firewall application privileges and authorizations must either be configured in the authentication server or synchronized once configured on the firewall.
This requirement applies to logical access authorizations for user accounts which are managed and controlled using the firewall application rather than the operating system or network authentication server. Accounts created and maintained on authentication servers (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.
This requirement does not apply to local emergency accounts or system accounts. |
