The system must be configured to only boot from the system boot device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1013	GEN008600	SV-38234r1_rule	ECSC-1	High

Description
The ability to boot from removable media is the same as being able to boot into single user, or maintenance, mode without a password. This ability could allow a malicious user to boot the system and perform changes possibly compromising or damaging the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2018-09-14

Details

Check Text ( C-36795r1_chk )
HP-UX 11-v3 may be booted from the following system startup media (must have been previously configured by root): • Hard drives • CD/DVD drives (for installation) • Tape drives (for installation) • USB directly connected drives (no hubs) Determine if the system is configured to boot from devices other than the system startup media. Verification should (optimally) be performed during IPL/ISL boot. In lieu of rebooting the system, ask the SA if the system is configured to boot from devices other than system startup media. If so, this is a finding.

Check Text ( C-36795r1_chk )

HP-UX 11-v3 may be booted from the following system startup media (must have been previously configured by root):
• Hard drives
• CD/DVD drives (for installation)
• Tape drives (for installation)
• USB directly connected drives (no hubs)

Determine if the system is configured to boot from devices other than the system startup media. Verification should (optimally) be performed during IPL/ISL boot. In lieu of rebooting the system, ask the SA if the system is configured to boot from devices other than system startup media. If so, this is a finding.

Fix Text (F-32173r1_fix)
Configure the system to only boot from system startup media. The system must first be rebooted in order to set primary and alternate boot paths for the desired system startup media.