The MDM server must use multifactor authentication via an Enterprise Authentication Mechanism for local access to privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36038	SRG-APP-151-MDM-034-SRV	SV-47427r1_rule		High

Description
Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As privileged users have access to most of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric).

Description

Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As privileged users have access to most of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric).

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44277r1_chk )
Review the MDM server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism via multifactor authentication. If the MDM server is not authenticating through the Enterprise Authentication Mechanism, this is a finding. If the MDM server is not configured for multifactor authentication, this is a finding.

Fix Text (F-40568r1_fix)
Configure MDM server to authenticate through the Enterprise Authentication Mechanism. Configure the MDM server for multifactor authentication.