UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The network device must authenticate an organizationally defined list of specific devices by device type before establishing a connection.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000148-NDM-000107 SRG-NET-000148-NDM-000107 SRG-NET-000148-NDM-000107_rule Low
Description
A network device must have a level of trust with any node wanting to connect to it. Device authentication prevents an authorized user from connecting to perform privileged functions using a device which may contain security issues which may provide a vector for compromising the network device. Communications to the network device must be carefully restricted. Today's devices may need to communicate with the network device, router, SYSLOG server, other network device, and management clients. This control requires the organization to define these devices specifically and to identify these approved devices by type (e.g., network device, router, remote PC, etc.). Thus, the authentication decision must take the device type, not just the user's authorization into account when allowing access. For example, a system administrator may be authorized access; however, access must also be from an authorized device.
STIG Date
Network Device Management Security Requirements Guide 2013-07-30

Details

Check Text ( C-SRG-NET-000148-NDM-000107_chk )
Verify communications to other network devices (e.g., sensors, routers, SYSLOG servers, and forensics servers) are configured to establish authentication using a unique identifier.
Verify authentication is based on an organizationally defined list of authorized device types.

If devices not included on the organizationally defined list of authorized device types are allowed to connect, this is a finding.
Fix Text (F-SRG-NET-000148-NDM-000107_fix)
Configure the network device to authenticate based on an organizationally defined list of authorized device types.