Navigate

Check: ISEC-06-000660

ISEC7 Sphere STIG: ISEC-06-000660 (in version v2 r1)

Title

ISEC7 EMM Suite must disable or delete local account created during application installation and configuration. (Cat I impact)

Discussion

The ISEC7 local account password complexity controls do not meet DoD requirements; therefore, admins have the capability to configure the account out of compliance, which could allow attacker to gain unauthorized access to the server and access to command MDM servers.

Check Content

Log in to the ISEC7 EMM Suite console. Navigate to Administration >> Configuration >> Account Management >> Users. Select Edit next to the local account Admin. Verify Login disabled has been selected. If Login disabled has not been selected, this is a finding.

Fix Text

Log in to the ISEC7 EMM Suite console. Navigate to Administration >> Configuration >> Account Management >> Users. Select Edit next to the local account Admin. Check Login disabled for the account. Click Save.

Additional Identifiers

Rule ID: SV-224767r505933_rule

Vulnerability ID: V-224767

Group Title: SRG-APP-000148

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000764	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-2	Identification And Authentication (Organizational Users)