UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The network device must use organizationally defined replay-resistant authentication mechanisms for network access to privileged accounts.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000146-NDM-000106 SRG-NET-000146-NDM-000106 SRG-NET-000146-NDM-000106_rule Medium
Description
All authentication credentials must be maintained on an authentication server. Messages between the authenticator and the network device validating user credentials must not be vulnerable to a replay attack possibly enabling an unauthorized user to gain access to any network device. A replay attack is a network attack in which a valid session or series of IP packets is intercepted by a malicious user who later transmits the packets to gain access to the target device.
STIG Date
Network Device Management Security Requirements Guide 2013-07-30

Details

Check Text ( C-SRG-NET-000146-NDM-000106_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the network device application itself, this is not a finding.

Verify the configuration for the network device requires access by a DoD-approved replay-resistant authentication method, such as DoD PKI or DoD Alternate Token.

If DoD PKI or DoD Alternate Token is not used for authentication, this is a finding.
Fix Text (F-SRG-NET-000146-NDM-000106_fix)
Configure local accounts to use DoD-approved, replay resistant authentication mechanisms for access to the network device. Approved methods are DoD PKI or DoD Alternate Token.