The IDPS must protect non-local maintenance sessions through the use of two-factor authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000174-IDPS-000162	SRG-NET-000174-IDPS-000162	SRG-NET-000174-IDPS-000162_rule		Medium

Description
Without authentication anyone with logical access can access IDPS components allowing intruders to compromise resources within the network infrastructure. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organizations security policy. Authorization for access to any IDPS requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of all administrator accounts for all privilege levels must be accomplished using two or more factors that include the following: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

Description

Without authentication anyone with logical access can access IDPS components allowing intruders to compromise resources within the network infrastructure. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organizations security policy. Authorization for access to any IDPS requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of all administrator accounts for all privilege levels must be accomplished using two or more factors that include the following: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43302_chk )
Verify the configuration for the management console and sensors requires access by a DoD approved multi-factor authentication (e.g., PKI, SecureID, or DoD Alternate Token). If multifactor authentication is not used for non-local maintenance sessions, this is a finding.

Fix Text (F-43302_fix)
Use a AAA server configured for multifactor authentication for non-local maintenance sessions. Do not use local accounts except when necessary.