The IDPS must enforce password encryption for transmission.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000161-IDPS-000144	SRG-NET-000161-IDPS-000144	SRG-NET-000161-IDPS-000144_rule		High

Description
Authorization for access to any IDPS requires an approved and assigned individual account identifier. To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The IDPS can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the IDPS. It is imperative to encrypt passwords before transmitting during any authentication process.

Description

Authorization for access to any IDPS requires an approved and assigned individual account identifier. To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The IDPS can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the IDPS. It is imperative to encrypt passwords before transmitting during any authentication process.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43283_chk )
View the password configuration or system documentation. Verify system is configured to encrypt passwords when logging on both locally and non-locally. If passwords are sent in clear text, this is a finding.

Fix Text (F-43283_fix)
Configure passwords to use encryption when authenticating.