The network device must enforce password encryption for transmission.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000161-NDM-000118	SRG-NET-000161-NDM-000118	SRG-NET-000161-NDM-000118_rule		Medium

Description
To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The network device can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the network device. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the network device itself.

Description

To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The network device can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the network device. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the network device itself.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000161-NDM-000118_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the network device application itself, this is not a finding. View the password configuration or system documentation. Verify the system is configured to encrypt passwords when logging on both locally and non-locally. If passwords are sent in clear text, this is a finding.

Check Text ( C-SRG-NET-000161-NDM-000118_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the network device application itself, this is not a finding.

View the password configuration or system documentation.
Verify the system is configured to encrypt passwords when logging on both locally and non-locally.

If passwords are sent in clear text, this is a finding.

Fix Text (F-SRG-NET-000161-NDM-000118_fix)
Configure the network device to encrypt passwords prior to transmission as part of the authentication process.