UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Mainframe Product must require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan.


Overview

Finding ID Version Rule ID IA Controls Severity
V-68329 SRG-APP-000390-MFP-000205 SV-82819r1_rule Medium
Description
Without reauthenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of devices, including (but not limited to), the following other situations. (i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change; (iv) After a fixed period of time; or (v) Periodically. For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions. Gateways and SOA applications are examples of where this requirement would apply.
STIG Date
Mainframe Product Security Requirements Guide 2019-12-12

Details

Check Text ( C-68889r1_chk )
If the Mainframe Product has no function or capability for device logon, this is not applicable.

If the Mainframe Product employs an external security manager for all account management functions, this is not applicable.

Examine user account management configurations.

If the Mainframe Product is configured to require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan, this is not a finding.
Fix Text (F-74443r1_fix)
Configure the Mainframe Product to require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan.