The KVM switch must be configured to force the change of the configuration password every 90 days or there is no policy and procedure in place to change the configuration password every 90 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6686	KVM02.002.00	SV-6848r2_rule	DCBP-1	Medium

Description
The longer the time between password changes the greater the chance the password will become compromised. A compromised password can allow a malicious user to change the configuration of the KVM switch creating a denial of service or a compromise of sensitive data. The ISSO will ensure the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days.

Description

The longer the time between password changes the greater the chance the password will become compromised. A compromised password can allow a malicious user to change the configuration of the KVM switch creating a denial of service or a compromise of sensitive data. The ISSO will ensure the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days.

STIG	Date
Keyboard Video and Mouse Switch STIG	2015-12-09

Details

Check Text ( C-2636r2_chk )
The reviewer will, with the assistance of the ISSO or SA, verify the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days. If the switch is not configured or there is no policy or procedure in place to force a configuration password change every 90 days, this is a finding.

Check Text ( C-2636r2_chk )

The reviewer will, with the assistance of the ISSO or SA, verify the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days. If the switch is not configured or there is no policy or procedure in place to force a configuration password change every 90 days, this is a finding.

Fix Text (F-6276r1_fix)
Configure the KVM switch to force the change of the configuration password every 90 days or if the KVM switch does not support this functionality, create a policy and procedure to change the configuration password every 90 days.