Check: F5BI-DM-000043
F5 BIG-IP Device Management STIG:
F5BI-DM-000043
(in versions v2 r3 through v1 r3)
Title
The BIG-IP appliance must be configured to protect against an individual (or process acting on behalf of an individual) falsely denying having performed system configuration changes. (Cat II impact)
Discussion
This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement. To meet this requirement, the network device must log administrator access and activity.
Check Content
Verify the BIG-IP appliance is configured to use a properly configured authentication server that protects against an individual (or process acting on behalf of an individual) falsely denying having performed system configuration changes. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify "Authentication: User Directory" is configured for an approved remote authentication server that protects against an individual falsely denying having performed system configuration changes. If the BIG-IP appliance is not configured to protect against an individual (or process acting on behalf of an individual) falsely denying having performed system configuration changes, this is a finding.
Fix Text
Configure the BIG-IP appliance to use a properly configured authentication server to protect against an individual (or process acting on behalf of an individual) falsely denying having performed system configuration changes.
Additional Identifiers
Rule ID: SV-217390r879554_rule
Vulnerability ID: V-217390
Group Title: SRG-APP-000080-NDM-000220
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000166 |
The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. |
Controls
Number | Title |
---|---|
AU-10 |
Non-Repudiation |