Administrators in the role of either Security Administrator or Cryptographic Administrator must not also have the role of Audit Administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62745	PANW-NM-000075	SV-77235r1_rule		Medium

Description
The Palo Alto Networks security platform has both pre-configured and configurable Administrator roles. Administrator roles determine the functions that the administrator is permitted to perform after logging in. Roles can be assigned directly to an administrator account, or define role profiles, which specify detailed privileges, and assign those to administrator accounts. There are three preconfigured roles designed to comply with Common Criteria requirements - Security Administrator, Audit Administrator, and Cryptographic Administrator. Of the three, only the Audit Administrator can delete audit records. The Palo Alto Networks security platform can use both pre-configured and configurable Administrator roles.

Description

The Palo Alto Networks security platform has both pre-configured and configurable Administrator roles. Administrator roles determine the functions that the administrator is permitted to perform after logging in. Roles can be assigned directly to an administrator account, or define role profiles, which specify detailed privileges, and assign those to administrator accounts. There are three preconfigured roles designed to comply with Common Criteria requirements - Security Administrator, Audit Administrator, and Cryptographic Administrator. Of the three, only the Audit Administrator can delete audit records. The Palo Alto Networks security platform can use both pre-configured and configurable Administrator roles.

STIG	Date
Palo Alto Networks NDM Security Technical Implementation Guide	2017-07-07

Details

Check Text ( C-63553r2_chk )
If the Palo Alto Networks security platform has any accounts where the same person is in the role of both Security Administrator and Cryptographic Administrator, this is a finding. Note: Each account can only have one role, but individuals, either accidentally or intentionally, may have more than one account.

Fix Text (F-68665r1_fix)
Do not assign or configure more than one account to the same Administrator.