The network device must automatically disable inactive accounts after an organization defined time period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000004-NDM-000004	SRG-NET-000004-NDM-000004	SRG-NET-000004-NDM-000004_rule		Low

Description
Since the accounts in the network device are privileged or system level accounts, account management is vital to the security of the network device. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the network device. This control does not include emergency administration accounts which are meant for access to the network device components in case of network failure. This requirement is applicable to accounts created or managed using the network device application. Accounts created and maintained on an authentication server (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

Description

Since the accounts in the network device are privileged or system level accounts, account management is vital to the security of the network device. Inactive accounts could be reactivated or compromised by unauthorized users allowing exploitation of vulnerabilities and undetected access to the network device. This control does not include emergency administration accounts which are meant for access to the network device components in case of network failure. This requirement is applicable to accounts created or managed using the network device application. Accounts created and maintained on an authentication server (e.g., RADIUS, LDAP, or Active Directory) are secured using the applicable security guide or STIG.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000004-NDM-000004_chk )
Review the account settings to determine if the network device automatically disables inactive accounts after an organizationally defined time period. If the ability to disable inactive accounts is not automated or utilized, this is a finding.

Fix Text (F-SRG-NET-000004-NDM-000004_fix)
Configure the network device to automatically disable inactive accounts after an organizationally defined time period of inactivity.