Riverbed Optimization System (RiOS) must enforce a minimum 15-character password length.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62961	RICX-DM-000114	SV-77451r1_rule		Medium

Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

Description

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

STIG	Date
Riverbed SteelHead CX v8 NDM Security Technical Implementation Guide	2019-10-01

Details

Check Text ( C-63713r1_chk )
Verify that RiOS is configured to enforce a minimum 15-character password length. Navigate to the device Management Console Navigate to Configure >> Security >> Password Policy Verify that "Minimum Password Length:" is set to "15" If "Minimum Password Length:" is not set to "15", this is a finding.

Fix Text (F-68879r1_fix)
Configure RiOS to enforce a minimum 15-character password length. Navigate to the device Management Console Navigate to Configure >> Security >> Password Policy Set the value of "Minimum Password Length:" to "15" Click "Apply" Navigate to the top of the web page and click "Save" to save these settings permanently