The IDPS must enforce multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the IDPS being accessed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34638	SRG-NET-000144-IDPS-00106	SV-45513r1_rule		Medium

Description
Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As privileged users have access to most of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). When one of the authentication factors is provided by a device that is separate from the system that is gaining access, this is referred to as Out of Band Two Factor Authentication (OOB2FA). OOB2FA employs separate communication channels at least one of which is independently maintained and trusted to authenticate an end user.

Description

Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As privileged users have access to most of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). When one of the authentication factors is provided by a device that is separate from the system that is gaining access, this is referred to as Out of Band Two Factor Authentication (OOB2FA). OOB2FA employs separate communication channels at least one of which is independently maintained and trusted to authenticate an end user.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42862r1_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding. Verify the configuration for the management console and sensors requires access by a DoD approved multifactor authentication (e.g., PKI, SecureID, or DoD Alternate Token) mechanism. If multifactor authentication is not used for network access to privileged accounts, this is a finding.

Check Text ( C-42862r1_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding.

Verify the configuration for the management console and sensors requires access by a DoD approved multifactor authentication (e.g., PKI, SecureID, or DoD Alternate Token) mechanism.

If multifactor authentication is not used for network access to privileged accounts, this is a finding.

Fix Text (F-38910r1_fix)
Configure the IDPS to require multifactor authentication, with one of the factors being a device separate from the information system gaining access, when accessing privileged accounts via the network.