UCF STIG Viewer Logo

The vAMI account credentials must protected by site policies.


Overview

Finding ID Version Rule ID IA Controls Severity
V-90241 VRAU-VA-000385 SV-100891r1_rule Medium
Description
Application servers provide remote access capability and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by logging connection activities of remote users. Examples of policy requirements include, but are not limited to, authorizing remote access to the information system, limiting access based on authentication credentials, and monitoring for unauthorized access.
STIG Date
VMW vRealize Automation 7.x vAMI Security Technical Implementation Guide 2018-10-12

Details

Check Text ( C-89933r1_chk )
Interview the ISSO and/or the SA.

Determine if access credentials for the vAMI are controlled by a site policy.

If a site policy does not exist, or is not being followed, this is a finding.
Fix Text (F-96983r1_fix)
Develop and implement a site procedure to control access credentials for the vAMI.