Title

The HYCU virtual appliance must enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device. (Cat I impact)

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement.

Check Content

Review the Self-Service menu within HYCU to view accounts and user roles (Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer). User roles have a predefined and nonchangeable set of user privileges. To check exact set of privileges of each user, navigate to Self-Service context in the HYCU UI. Click on the question mark in the upper-right corner, followed by "Help with This Page". Scroll down to the "User Roles" section. If users can perform more functions than those specified for their role, this is a finding.

Fix Text

Apply the appropriate user role to the required user from one of the predefined and nonchangeable roles: Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer.

Additional Identifiers

Rule ID: SV-268222r1038366_rule

Vulnerability ID: V-268222

Group Title: SRG-APP-000033-NDM-000212

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.