UCF STIG Viewer Logo

The IDPS must obscure feedback of authentication information during the authentication process to protect the information from possible use by unauthorized individuals.


Overview

Finding ID Version Rule ID IA Controls Severity
V-34684 SRG-NET-000167-IDPS-00125 SV-45563r1_rule Medium
Description
To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the information system shall not provide any information that would allow an unauthorized user to compromise the authentication mechanism. During the authentication process, malicious users can gain knowledge of passwords by simply walking by a user logging on, and viewing what had been input. Obfuscation of user provided information when typed into the system is a method used in addressing this risk.
STIG Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide 2012-11-19

Details

Check Text ( C-42915r1_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding.

Review the IDPS configuration and settings to determine if authentication information (e.g., passwords) is displayed in clear text during authentication.

If passwords are displayed in clear text during the authentication process, this is a finding.
Fix Text (F-38960r1_fix)
Configure the authentication function to obscure feedback of authentication information during the authentication process.