The network element must be password protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3012	NET0230	SV-3012r2_rule	ECSC-1 IAIA-1 IAIA-2	High

Description
Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization’s security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network element. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network element providing opportunity for intruders to compromise resources within the network infrastructure.

Description

Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization’s security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network element. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network element providing opportunity for intruders to compromise resources within the network infrastructure.

STIG	Date
Layer 2 Switch Security Technical Implementation Guide - Cisco	2013-10-08

Details

Check Text ( C-3456r3_chk )
Review the network element configuration to determine if administrative access to the device requires some form of authentication—at a minimum a password is required.

Fix Text (F-3037r5_fix)
Configure the network element so it will require a password to gain administrative access to the device.