Check: SRG-APP-000153-NDM-000249
Network Device Management SRG:
SRG-APP-000153-NDM-000249
(in versions v4 r3 through v2 r7)
Title
The network device must be configured to authenticate each administrator prior to authorizing privileges based on assignment of group or role. (Cat II impact)
Discussion
To assure individual accountability and prevent unauthorized access, administrators must be individually identified and authenticated. Individual accountability mandates that each administrator is uniquely identified. A group authenticator is a shared account or some other form of authentication that allows multiple unique individuals to access the network device using a single account. If a device allows or provides for group authenticators, it must first individually authenticate administrators prior to implementing group authenticator functionality. Some devices may not have the need to provide a group authenticator; this is considered a matter of device design. In those instances where the device design includes the use of a group authenticator, this requirement will apply. This requirement applies to accounts created and managed on or by the network device.
Check Content
Determine if the network device ensures that administrators are authenticated with an individual authenticator prior to using a group authenticator. This requirement may be verified by demonstration, configuration review, or validated test results. If the network device does not authenticate administrators with an individual authenticator prior to using a group authenticator, this is a finding.
Fix Text
Configure the network device to ensure administrators are authenticated with an individual authenticator prior to using a group authenticator.
Additional Identifiers
Rule ID: SV-202054r879594_rule
Vulnerability ID: V-202054
Group Title: SRG-APP-000153
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000770 |
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed. |
Controls
Number | Title |
---|---|
IA-2 (5) |
Group Authentication |