The network device must implement role-based management to allow authorized administrators to enable/disable organizationally defined security policy filters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000021-NDM-000020	SRG-NET-000021-NDM-000020	SRG-NET-000021-NDM-000020_rule		Medium

Description
Organizationally defined security policy filters include dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters. Configuration and enforcement of administrator privileges ensures only authorized users have access to certain commands and functions on the network device. This control can be met by assigning the privilege to enable or disable security policy filters to privilege groups and then assigning users to these groups (role-based access control). Authorization to add, modify, or delete security policy filters must require the highest privilege level. If system administrators cannot be configured with different security privileges, then need-to-know cannot be enforced.

Description

Organizationally defined security policy filters include dirty word filters, file type checking filters, structured data filters, unstructured data filters, metadata content filters, and hidden content filters. Configuration and enforcement of administrator privileges ensures only authorized users have access to certain commands and functions on the network device. This control can be met by assigning the privilege to enable or disable security policy filters to privilege groups and then assigning users to these groups (role-based access control). Authorization to add, modify, or delete security policy filters must require the highest privilege level. If system administrators cannot be configured with different security privileges, then need-to-know cannot be enforced.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000021-NDM-000020_chk )
Verify only authorized network device administrators have accounts capable of enabling or disabling security policy filters. If auditors or other restricted administrators have access to update ACLs or security policies, this is a finding.

Fix Text (F-SRG-NET-000021-NDM-000020_fix)
Assign the privileges to enable and disable organizationally defined security policy filters to security groups. Assign only administrators who are authorized to perform enabling and disabling of security policy filters to these security groups.