The MDM server must disable administrative accounts after an organization defined time period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36041	SRG-APP-163-MDM-037-SRV	SV-47430r1_rule		High

Description
Users are often the first line of defense within an application. Active users take notice of system and data conditions and are usually the first to notify systems administrators when they notice a system or application related anomaly, particularly if the anomaly is related to their own account. Inactive user accounts pose a risk to systems and applications. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to the system. Systems need to track periods of user inactivity and disable accounts after an organization defined period of inactivity. Such a process greatly reduces the risk that accounts will be misused, hijacked, or will have data compromised.

Description

Users are often the first line of defense within an application. Active users take notice of system and data conditions and are usually the first to notify systems administrators when they notice a system or application related anomaly, particularly if the anomaly is related to their own account. Inactive user accounts pose a risk to systems and applications. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to the system. Systems need to track periods of user inactivity and disable accounts after an organization defined period of inactivity. Such a process greatly reduces the risk that accounts will be misused, hijacked, or will have data compromised.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44280r1_chk )
Review the MDM server configuration to ensure the MDM server disables administrator accounts after an organization defined time period of inactivity. If the MDM server is not configured to disable administrator accounts after an organization defined time period of inactivity, this is a finding.

Fix Text (F-40571r1_fix)
Configure the MDM server to disable inactive administrator accounts per the organizations specified time period.