The network device must automatically terminate temporary accounts after an organization defined time period for each type of account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000002-NDM-000002	SRG-NET-000002-NDM-000002	SRG-NET-000002-NDM-000002_rule		Medium

Description
Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the network device since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. This requirement is applicable to temporary accounts created or managed using the network device application itself rather than the underlying OS or an authentication server. Accounts created and maintained on an authentication server (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the network device since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. This requirement is applicable to temporary accounts created or managed using the network device application itself rather than the underlying OS or an authentication server. Accounts created and maintained on an authentication server (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000002-NDM-000002_chk )
If the site's security plan does not permit the use of temporary accounts for access to the network device, this is not a finding. Review the network device to ensure accounts can be configured to automatically terminate specified user accounts. If the network device components do not automatically terminate temporary accounts after an organizationally defined time period, based on the type of account, this is a finding.

Check Text ( C-SRG-NET-000002-NDM-000002_chk )

If the site's security plan does not permit the use of temporary accounts for access to the network device, this is not a finding.

Review the network device to ensure accounts can be configured to automatically terminate specified user accounts.

If the network device components do not automatically terminate temporary accounts after an organizationally defined time period, based on the type of account, this is a finding.

Fix Text (F-SRG-NET-000002-NDM-000002_fix)
Configure the network device to automatically terminate temporary accounts after an organizationally defined time period, based on the type of account. An acceptable method would be to place an expiration date on the account upon creation.