The IDPS must automatically terminate emergency accounts after an organizationally defined time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34464	SRG-NET-000003-IDPS-00003	SV-45188r1_rule		Low

Description
Emergency accounts are established in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency accounts are not to be confused with infrequently used accounts (e.g., local login accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic termination dates. If these accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the IDPS since these accounts have elevated privileges. To mitigate this risk, automated termination of all emergency accounts must be set upon account creation. This requirement is applicable for accounts created or maintained using the IDPS application itself rather than the underlying OS or an authentication server. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Emergency accounts are established in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency accounts are not to be confused with infrequently used accounts (e.g., local login accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic termination dates. If these accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the IDPS since these accounts have elevated privileges. To mitigate this risk, automated termination of all emergency accounts must be set upon account creation. This requirement is applicable for accounts created or maintained using the IDPS application itself rather than the underlying OS or an authentication server. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42534r1_chk )
If the site's security plan does not permit the use of emergency accounts for access to the IDPS, this is not a finding. Review the IDPS to ensure the system is configured to automatically terminate emergency accounts after an organizationally defined time period. If the IDPS components do not automatically terminate emergency accounts after an organizationally defined time period, this is a finding.

Check Text ( C-42534r1_chk )

If the site's security plan does not permit the use of emergency accounts for access to the IDPS, this is not a finding.
Review the IDPS to ensure the system is configured to automatically terminate emergency accounts after an organizationally defined time period.

If the IDPS components do not automatically terminate emergency accounts after an organizationally defined time period, this is a finding.

Fix Text (F-38582r1_fix)
Configure the IDPS to automatically terminate emergency accounts after an organizationally defined time period.