The IDPS must automatically disable inactive accounts after an organizationally defined time period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34465	SRG-NET-000004-IDPS-00004	SV-45189r1_rule		Low

Description
Since the accounts in the IDPS are privileged or system level accounts, account management is vital to the security of the IDPS. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the IDPS. The control does not include emergency administration accounts which are meant for access to the IDPS components in case of network failure. These accounts must not be automatically disabled. This requirement is applicable for accounts created or maintained using the IDPS application. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Since the accounts in the IDPS are privileged or system level accounts, account management is vital to the security of the IDPS. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the IDPS. The control does not include emergency administration accounts which are meant for access to the IDPS components in case of network failure. These accounts must not be automatically disabled. This requirement is applicable for accounts created or maintained using the IDPS application. Accounts created and maintained on AAA devices (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42536r2_chk )
Review the account settings to determine if the IDPS automatically disables inactive accounts after an organizationally defined time period. If the ability to disable inactive accounts is not automated or utilized, this is a finding.

Fix Text (F-38584r1_fix)
Configure the IDPS to automatically disable inactive accounts after an organizationally defined time period of inactivity.