The firewall implementation must enforce a DAC policy that includes or excludes access to the granularity of a single user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37331	SRG-NET-000307-FW-000161	SV-49092r1_rule		Medium

Description
Access control policies (e.g., identity-based policies and role-based policies) and access enforcement mechanisms (e.g., access control lists, policy maps, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, data, and destination addresses) within the network. This applies to locally defined accounts where the user management functionality is part of the firewall application. This control does not negate the use of security groups for assigning access control to each member. Without granular DAC policies, access control and enforcement mechanisms will not prevent unauthorized access to account information, system logs, and other files.

Description

Access control policies (e.g., identity-based policies and role-based policies) and access enforcement mechanisms (e.g., access control lists, policy maps, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, data, and destination addresses) within the network. This applies to locally defined accounts where the user management functionality is part of the firewall application. This control does not negate the use of security groups for assigning access control to each member. Without granular DAC policies, access control and enforcement mechanisms will not prevent unauthorized access to account information, system logs, and other files.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45579r1_chk )
Verify the site has configured the firewall to implement an access control policy that grants access to objects to the granularity of a single user. If the system does not enforce a DAC policy that includes or excludes access to the granularity of a single user, this is a finding.

Fix Text (F-42256r1_fix)
Configure the firewall implementation to use an access control policy that includes or excludes access to the granularity of a single user.