The VMM must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207480	SRG-OS-000375-VMM-001510	SV-207480r984255_rule		Medium

Description
Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD common access card. A privileged account is defined as a VMM account with authorizations of a privileged user. Remote access is access to DOD nonpublic VMMs by an authorized user (or a VMM) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Description

Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD common access card. A privileged account is defined as a VMM account with authorizations of a privileged user. Remote access is access to DOD nonpublic VMMs by an authorized user (or a VMM) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

STIG	Date
Virtual Machine Manager Security Requirements Guide	2024-05-28

Details

Check Text ( C-7737r365844_chk )
Verify the VMM implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. If it does not, this is a finding.

Fix Text (F-7737r365845_fix)
Configure the VMM to implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.