The Palo Alto Networks security platform must not use the default admin account password.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228676	PANW-NM-000143	SV-228676r513633_rule		High

Description
To assure accountability and prevent unauthenticated access, organizational administrators must be uniquely identified and authenticated for all network management accesses to prevent potential misuse and compromise of the system. The use of a default password for any account, especially one for administrative access, can quickly lead to a compromise of the device and subsequently, the entire enclave or system. The "admin" account is intended solely for the initial setup of the device and must be disabled when the device is initially configured. The default password for this account must immediately be changed at the first login of an authorized administrator.

Description

To assure accountability and prevent unauthenticated access, organizational administrators must be uniquely identified and authenticated for all network management accesses to prevent potential misuse and compromise of the system. The use of a default password for any account, especially one for administrative access, can quickly lead to a compromise of the device and subsequently, the entire enclave or system. The "admin" account is intended solely for the initial setup of the device and must be disabled when the device is initially configured. The default password for this account must immediately be changed at the first login of an authorized administrator.

STIG	Date
Palo Alto Networks NDM Security Technical Implementation Guide	2022-09-14

Details

Check Text ( C-30911r513631_chk )
Open a web browser at an authorized workstation and enter the management IP address of the Palo Alto Networks security platform. Use HTTP Secure (HTTPS) instead of HTTP since HTTP is disabled by default. The logon window will appear. Enter "admin" into both the "Name" and "Password" fields. If anything except the logon screen with the message "Invalid username or password" appears, this is a finding.

Check Text ( C-30911r513631_chk )

Open a web browser at an authorized workstation and enter the management IP address of the Palo Alto Networks security platform.
Use HTTP Secure (HTTPS) instead of HTTP since HTTP is disabled by default.
The logon window will appear.
Enter "admin" into both the "Name" and "Password" fields.
If anything except the logon screen with the message "Invalid username or password" appears, this is a finding.

Fix Text (F-30888r513632_fix)
Go to Device >> Administrators Select the admin user. In the "Old Password" field, enter "admin". In the "New Password" field, enter the new password. In the "Confirm New Password" field, enter the new password. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.