UCF STIG Viewer Logo

The IDPS must enforce multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the IDPS being accessed.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000144-IDPS-000134 SRG-NET-000144-IDPS-000134 SRG-NET-000144-IDPS-000134_rule Medium
Description
Multifactor authentication is defined as: using two or more factors to achieve authentication. Factors include: (i) something you know (e.g. password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). A privileged account is defined as: An information system account with authorizations of a privileged user. When one of the authentication factors is provided by a device that is separate from the system that is gaining access, this is referred to as "out of band two factor authentication". OOB2FA employs separate communication channels at least one of which is independently maintained and trusted to authenticate an end user. One channel could be a mobile device that is registered to the user. Upon a logon attempt, the system sends instructions to the device in the form of on-screen prompts that instruct the user how to complete the login process. Multifactor authentication provides strong protection for authentication mechanisms. Without a strong authentication method, the system is more easily breached by standard access control attacks.
STIG Date
IDPS Security Requirements Guide (SRG) 2012-03-08

Details

Check Text ( C-43269_chk )
Verify the configuration for the management console and sensors requires access by a DoD approved multi-factor authentication (e.g., PKI, SecureID, or DoD Alternate Token).

If multifactor authentication is not used for network access to privileged accounts, this is a finding.
Fix Text (F-43269_fix)
Configure local account for multi-factor authentication.