Title

Forescout must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. (Cat III impact)

Discussion

Display of the DoD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users. The banner must be formatted in accordance with DTM-08-060.

Check Content

1. Log on to the Forescout Administrator UI. 2. Select Tools >> Options >> CounterACT User Profiles >> Password and Sessions. 3. Select the Login tab and check the "Display this Notice and Consent Message after login" option. 4. Select the "Before login, prompt user to accept these Terms and Conditions" and view the text. If the banner is not present or not in exact compliance with the current verbiage and spacing in DTM-08-060, this is a finding.

Fix Text

Log on to the Forescout Administrator UI. 1. Select Tools >> Options >> CounterACT User Profiles >> Password and Sessions. 2. Select the "Login" tab and check the "Display this Notice and Consent Message after login" option. 3. Select the "Before login, prompt user to accept these Terms and Conditions". 4. Copy the exact text and formatting for the Standard Mandatory DoD and Consent Banner into the white box. Be sure to adhere to the exact line spacing required by DTM-08-060.

Additional Identifiers

Rule ID: SV-230934r615887_rule

Vulnerability ID: V-230934

Group Title: SRG-APP-000068-NDM-000215

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.