Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
SRG-NET-000146-NDM-000106 | SRG-NET-000146-NDM-000106 | SRG-NET-000146-NDM-000106_rule | Medium |
Description |
---|
All authentication credentials must be maintained on an authentication server. Messages between the authenticator and the network device validating user credentials must not be vulnerable to a replay attack possibly enabling an unauthorized user to gain access to any network device. A replay attack is a network attack in which a valid session or series of IP packets is intercepted by a malicious user who later transmits the packets to gain access to the target device. |
STIG | Date |
---|---|
Network Device Management Security Requirements Guide | 2013-07-30 |
Check Text ( C-SRG-NET-000146-NDM-000106_chk ) |
---|
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the network device application itself, this is not a finding. Verify the configuration for the network device requires access by a DoD-approved replay-resistant authentication method, such as DoD PKI or DoD Alternate Token. If DoD PKI or DoD Alternate Token is not used for authentication, this is a finding. |
Fix Text (F-SRG-NET-000146-NDM-000106_fix) |
---|
Configure local accounts to use DoD-approved, replay resistant authentication mechanisms for access to the network device. Approved methods are DoD PKI or DoD Alternate Token. |