The KVM switch is not configured to force the change of the configuration password every 90 days or that there is no policy and procedure in place to change the configuration password every 90 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6686	KVM02.002.00	SV-6848r1_rule	DCBP-1	Medium

Description

The longer time between password changes the greater the chance that the password will become compromised. A compromised password can allow a malicious user to change the configuration of the KVM switch creating a denial of service or a compromise of sensitive data. The IAO will ensure that the KVM switch is configured to force the change of the configuration password every 90 days or that there is a policy and procedure in place to change the configuration password every 90 days.

STIG	Date
Keyboard Video and Mouse Switch STIG	2014-08-04

Details

Check Text ( C-2636r1_chk )
The reviewer will, with the assistance of the IAO or SA, verify that the KVM switch is configured to force the change of the configuration password every 90 days or that there is a policy and procedure in place to change the configuration password every 90 days.

Fix Text (F-6276r1_fix)
Configure the KVM switch to force the change of the configuration password every 90 days or if the KVM switch does not support this functionality, create a policy and procedure to change the configuration password every 90 days.