Trend Deep Security must enforce a 60-day maximum password lifetime restriction.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-65925	TMDS-00-000165	SV-80415r1_rule		Medium

Description

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.

STIG	Date
Trend Micro Deep Security 9.x Security Technical Implementation Guide	2016-02-26

Details

Check Text ( C-66573r1_chk )
Review the Trend Deep Security server configuration to ensure a 60 day maximum password lifetime restriction is enforced. Verify the policy value for minimum password length. If the value for “User password expires” under the Administration >> System Settings >> Security tab is not set to 60 Days, this is a finding.

Fix Text (F-72001r1_fix)
Configure the Trend Deep Security server to enforce a 60 day maximum password lifetime restriction. Configure the policy value for maximum password lifetime. Under the Administration >> System Settings >> Security tab, set the value for “User password expires” to 60.