Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
SRG-NET-000167-NDM-000124 | SRG-NET-000167-NDM-000124 | SRG-NET-000167-NDM-000124_rule | Medium |
Description |
---|
To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the information system shall not provide any information that would allow an unauthorized user to compromise the authentication mechanism. During the authentication process, malicious users can gain knowledge of passwords by simply walking by a user logging on, and viewing what had been input. Obfuscation of user provided information when typed into the system is a method used in addressing this risk. |
STIG | Date |
---|---|
Network Device Management Security Requirements Guide | 2013-07-30 |
Check Text ( C-SRG-NET-000167-NDM-000124_chk ) |
---|
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the network device application itself, this is not a finding. Review the network device configuration and settings to determine if authentication information (e.g., passwords) is displayed in clear text during authentication. If authentication information, such as passwords, is displayed in clear text during the authentication process, this is a finding. |
Fix Text (F-SRG-NET-000167-NDM-000124_fix) |
---|
Configure the authentication function to obscure feedback of authentication information during the authentication process. |