Riverbed NetProfiler Security Technical Implementation Guide


Overview

Date Finding Count (27)
2023-01-11 CAT I (High): 7 CAT II (Med): 18 CAT III (Low): 2
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-256072 High The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
V-256076 High The Riverbed NetProfiler must change the default admin credentials so they do not use the default manufacturer passwords when deployed.
V-256095 High The Riverbed NetProfiler must be configured to run an operating system release that is currently supported by the vendor.
V-256090 High The Riverbed NetProfiler must be configured to implement cryptographic mechanisms using a FIPS 140-2/140-3 validated algorithm to protect the confidentiality and integrity of all cryptographic functions.
V-256093 High The Riverbed NetProfiler must be configured to use an authentication server to authenticate users prior to granting administrative access.
V-256079 High The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
V-256084 High The Riverbed NetProfiler must be configured to terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
V-256073 Medium The Riverbed NetProfiler must enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 30 minutes, at a minimum.
V-256077 Medium The Riverbed NetProfiler must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
V-256075 Medium The Riverbed NetProfiler must be configured to retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
V-256074 Medium The Riverbed NetProfiler must be configured to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device.
V-256094 Medium The Riverbed NetProfiler must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider.
V-256097 Medium The network device must terminate shared/group account credentials when members leave the group.
V-256091 Medium The Riverbed NetProfiler must be configured to protect against known types of denial-of-service (DOS) attacks by restricting web and SSH access to the appliance.
V-256092 Medium The Riverbed NetProfiler must be configured to use redundant Syslog servers that are configured on a different system than the NetProfiler appliance.
V-256078 Medium The Riverbed NetProfiler must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
V-256088 Medium The Riverbed NetProfiler must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
V-256089 Medium The Riverbed NetProfiler must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
V-256082 Medium The Riverbed NetProfiler must require that at least one special character be used.
V-256083 Medium The Riverbed NetProfiler must be configured to terminate all sessions and network connections when nonlocal device maintenance is completed.
V-256080 Medium The Riverbed NetProfiler must be configured to enforce a minimum 15-character password length.
V-256081 Medium The Riverbed NetProfiler must configure the local account password to "require mixed case".
V-256086 Medium The Riverbed NetProfiler must be configured to record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
V-256087 Medium The Riverbed NetProfiler must be configured to record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.
V-256085 Medium The Riverbed NetProfiler must be configured to synchronize internal information system clocks using redundant authoritative time sources.
V-256071 Low The Riverbed NetProfiler must be configured to limit the number of concurrent sessions to one for the locally defined administrator account.
V-256096 Low The Riverbed NetProfiler must be configured to conduct backups of system-level information and system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.