Check: IMIC-11-004800
Ivanti MobileIron Core MDM Server STIG:
IMIC-11-004800
(in version v1 r1)
Title
The Ivanti MobileIron Core server must enforce a minimum 15-character password length. (Cat II impact)
Discussion
The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. Satisfies: FMT_SMF.1(2)b Reference: PP-MDM-431018
Check Content
Verify a 15-character length for local user accounts has been configured: 1. Log in to the Core console. 2. Security >> Password Policy. 3. Verify the Min Password Length is set to 15. If the Min Password Length is not set to 15, this is a finding.
Fix Text
Configure a 15-character length for local user accounts: 1. Log in to the Core console. 2. Security >> Password Policy. 3. Set Min Password Length to 15.
Additional Identifiers
Rule ID: SV-251407r806353_rule
Vulnerability ID: V-251407
Group Title: SRG-APP-000164-UEM-000094
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000205 |
The information system enforces minimum password length. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |