IBM Aspera Faspex must disable account identifiers after 35 days of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252579	ASP4-FA-050140	SV-252579r817907_rule		Medium

Description
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.

STIG	Date
IBM Aspera Platform 4.2 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56035r817905_chk )
If the IBM Aspera Faspex feature of the Aspera Platform is not installed, this is Not Applicable. Verify IBM Aspera Faspex disables account identifiers after 35 days of inactivity: - Log in to the IBM Aspera Faspex web page as a user with administrative privilege. - Select the "Server" tab. - Select the "Configuration" tab. - Select the "Security" section. - Under the "Faspex accounts" "Remove users" section, verify the following: - Verify the "Local users" option is checked. - Verify the "Local users" options is set to "35" days or less. - Verify the "DS users" option is checked. - Verify the "DS users" options is set to "35" days or less. - Verify the "SAML users" option is checked. - Verify the "SAML users" options is set to "35" days or less. If the "Local users" options is set to more than "35" days or the option is not checked, this is a finding. If the "DS users" options is set to more than "35" days or the option is not checked, this is a finding. If the "SAML users" options is set to more than "35" days or the option is not checked, this is a finding.

Check Text ( C-56035r817905_chk )

If the IBM Aspera Faspex feature of the Aspera Platform is not installed, this is Not Applicable.

Verify IBM Aspera Faspex disables account identifiers after 35 days of inactivity:

- Log in to the IBM Aspera Faspex web page as a user with administrative privilege.
- Select the "Server" tab.
- Select the "Configuration" tab.
- Select the "Security" section.
- Under the "Faspex accounts" "Remove users" section, verify the following:
- Verify the "Local users" option is checked.
- Verify the "Local users" options is set to "35" days or less.
- Verify the "DS users" option is checked.
- Verify the "DS users" options is set to "35" days or less.
- Verify the "SAML users" option is checked.
- Verify the "SAML users" options is set to "35" days or less.

If the "Local users" options is set to more than "35" days or the option is not checked, this is a finding.

If the "DS users" options is set to more than "35" days or the option is not checked, this is a finding.

If the "SAML users" options is set to more than "35" days or the option is not checked, this is a finding.

Fix Text (F-55985r817906_fix)
Configure IBM Aspera Faspex to disable account identifiers after 35 days of inactivity: - Log in to the IBM Aspera Faspex web page as a user with administrative privilege. - Select the "Server" tab. - Select the "Configuration" tab. - Select the "Security" section. - Under the "Faspex accounts" "Remove users" section, edit the following: - Put a check in the "Local users" option check box. - Edit the "Local users" option to "35" days or less. - Put a check in the "DS users" option check box. - Edit the "DS users" option to "35" days or less. - Put a check in the "SAML users" option check box. - Edit the "SAML users" option to "35" days or less. - Select "Update" at the bottom of the page.

Fix Text (F-55985r817906_fix)

Configure IBM Aspera Faspex to disable account identifiers after 35 days of inactivity:

- Log in to the IBM Aspera Faspex web page as a user with administrative privilege.
- Select the "Server" tab.
- Select the "Configuration" tab.
- Select the "Security" section.
- Under the "Faspex accounts" "Remove users" section, edit the following:
- Put a check in the "Local users" option check box.
- Edit the "Local users" option to "35" days or less.
- Put a check in the "DS users" option check box.
- Edit the "DS users" option to "35" days or less.
- Put a check in the "SAML users" option check box.
- Edit the "SAML users" option to "35" days or less.
- Select "Update" at the bottom of the page.