UCF STIG Viewer Logo

The KVM switch must be configured to force the change of the configuration password every 90 days or there is no policy and procedure in place to change the configuration password every 90 days.


Overview

Finding ID Version Rule ID IA Controls Severity
V-6686 KVM02.002.00 SV-6848r2_rule DCBP-1 Medium
Description
The longer the time between password changes the greater the chance the password will become compromised. A compromised password can allow a malicious user to change the configuration of the KVM switch creating a denial of service or a compromise of sensitive data. The ISSO will ensure the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days.
STIG Date
Keyboard Video and Mouse Switch STIG 2015-12-09

Details

Check Text ( C-2636r2_chk )
The reviewer will, with the assistance of the ISSO or SA, verify the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days. If the switch is not configured or there is no policy or procedure in place to force a configuration password change every 90 days, this is a finding.
Fix Text (F-6276r1_fix)
Configure the KVM switch to force the change of the configuration password every 90 days or if the KVM switch does not support this functionality, create a policy and procedure to change the configuration password every 90 days.