The network device must enforce a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000307-NDM-000192	SRG-NET-000307-NDM-000192	SRG-NET-000307-NDM-000192_rule		Low

Description
Access control policies (e.g., identity-based policies and role-based policies) and access enforcement mechanisms (e.g., access control lists, policy maps, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, data, and destination addresses) within the network. This applies to locally defined accounts where the user management functionality is part of the network device application. This control does not negate the use of security groups for assigning access control to each member. Without granular DAC policies, access control and enforcement mechanisms will not prevent unauthorized access to account information, system logs, and other files.

Description

Access control policies (e.g., identity-based policies and role-based policies) and access enforcement mechanisms (e.g., access control lists, policy maps, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, data, and destination addresses) within the network. This applies to locally defined accounts where the user management functionality is part of the network device application. This control does not negate the use of security groups for assigning access control to each member. Without granular DAC policies, access control and enforcement mechanisms will not prevent unauthorized access to account information, system logs, and other files.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000307-NDM-000192_chk )
Verify the site has configured the network device to implement an access control policy that grants access to objects to the granularity of a single user. If the system does not enforce a DAC policy that includes or excludes access to the granularity of a single user, this is a finding.

Fix Text (F-SRG-NET-000307-NDM-000192_fix)
Configure the network device to use an access control policy that includes or excludes access to the granularity of a single user.