The IDPS must enforce password encryption for transmission.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34678	SRG-NET-000161-IDPS-00119	SV-45555r1_rule		Medium

Description
To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The IDPS can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the IDPS. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the IDPS itself.

Description

To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The IDPS can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the IDPS. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the IDPS itself.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42904r1_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding. View the password configuration or system documentation. Verify the system is configured to encrypt passwords when logging on both locally and non-locally. If passwords are sent in clear text, this is a finding.

Check Text ( C-42904r1_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding.

View the password configuration or system documentation.
Verify the system is configured to encrypt passwords when logging on both locally and non-locally.

If passwords are sent in clear text, this is a finding.

Fix Text (F-38952r1_fix)
Configure the IDPS to encrypt passwords prior to transmission as part of the authentication process.