| Finding ID |
Severity |
Title |
Description |
|
V-252200
|
High |
The HPE Nimble must be running an operating system release that is currently supported by the vendor. |
Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities. |
|
V-252199
|
High |
The HPE Nimble must forward critical alerts (at a minimum) to the system administrators and the ISSO. |
Alerts are essential to let the system administrators and security personnel know immediately of issues which may impact the system or users. If these alerts are also sent to the syslog, this information is used to detect weaknesses in security that enable the network IA team to find and address... |
|
V-252197
|
High |
The HPE Nimble must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access. |
Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative... |
|
V-252196
|
High |
The HPE Nimble must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity. |
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by... |
|
V-259801
|
Medium |
HPE Alletra 5000/6000 must be configured to disable management by "HPE Greenlake: Data Services Cloud Console". |
DOD requires that the Mission Owner uses only the cloud services offering listed in either the FedRAMP or DISA PA DOD Cloud Catalog to host Unclassified, public-releasable, DOD information. Management by "HPE Greenlake: Data Services Cloud Console" is enabled by default for HPE Alletra and must be disabled. |
|
V-259800
|
Medium |
HPE Nimble must not be configured to use "HPE Greenlake: Data Services Cloud Console". |
DOD requires that the Mission Owner uses only the cloud services offering listed in either the FedRAMP or DISA PA DOD Cloud Catalog to host Unclassified, public-releasable, DOD information. Management by "HPE Greenlake: Data Services Cloud Console" is disabled by default for HPE Nimble and must not be enabled. |
|
V-252902
|
Medium |
HPE Nimble must be configured to disable HPE InfoSight. |
DoD requires that the Mission Owner uses only the cloud services offering listed in either the FedRAMP or DISA PA DoD Cloud Catalog to host Unclassified, public-releasable, DoD information.
HPE InfoSight data collection is disabled by default in the HPE Nimble. Users must not enable it. |
|
V-252203
|
Medium |
The HPE Nimble must configure a syslog server onto a different system or media than the system being audited. |
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
UDP is used to communicate between the array group and the syslog server (SSL is not supported at this time). This is an issue because DoD requires the use of TCP. One syslog message is generated... |
|
V-252202
|
Medium |
The HPE Nimble must be configured to synchronize internal information system clocks using an authoritative time source. |
The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions.
Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time... |
|
V-252201
|
Medium |
The HPE Nimble must limit the number of concurrent sessions to an organization-defined number for each administrator account. |
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to DoS attacks.
This requirement addresses concurrent sessions... |
|
V-252198
|
Medium |
The HPE Nimble must obtain its public key certificates from an appropriate certificate policy through an approved service provider. |
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority (CA) will suffice. |
|
V-252195
|
Medium |
The HPE Nimble must require that when a password is changed, the characters are changed in at least eight of the positions within the password. |
If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks.
The number of changed characters refers to the number of changes required with respect to the total... |
|
V-252194
|
Medium |
The HPE Nimble must enforce password complexity by requiring that at least one special character be used. |
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determine how long it... |
|
V-252193
|
Medium |
The HPE Nimble must enforce password complexity by requiring that at least one numeric character be used. |
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determine how long it... |
|
V-252192
|
Medium |
The HPE Nimble must enforce password complexity by requiring that at least one lowercase character be used. |
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determine how long it... |
|
V-252191
|
Medium |
The HPE Nimble must enforce password complexity by requiring that at least one uppercase character be used. |
Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determine how long it... |
|
V-252190
|
Medium |
The HPE Nimble must enforce a minimum 15-character password length. |
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password.
The shorter the password, the lower the number... |
|
V-252188
|
Medium |
The HPE Nimble must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. |
Display of the DoD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users. |
|
V-252187
|
Medium |
The HPE Nimble must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. |
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. |
|
V-252186
|
Medium |
The HPE Nimble must initiate a session lock after a 15-minute period of inactivity. |
A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Rather than relying on the user to manually lock their management session prior to vacating the vicinity, network devices need to be able to... |
