Title

Riverbed Optimization System (RiOS) must automatically generate a log event for account disabling actions. (Cat III impact)

Discussion

Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account disabling actions will support account management procedures. When device management accounts are disabled, user or service accessibility may be affected. Auditing also ensures authorized active accounts remain enabled and available for use when required.

Check Content

Verify that RiOS is configured to generate a log event for account creation events. Create an account To disable an account Navigate to the device Management Console, then Navigate to: Configure >> Security >> User >> Permissions Deselect Enable Account Click "Apply" Navigate to the device Management Console, then Navigate to: Reports >> Diagnostics >> System Logs Enter the account name into the filter and click Go Delete the account that was created If no event record for the user disabling action exists in the event log, this is a finding.

Fix Text

Configure RiOS to generate a log event for account disabling actions. Navigate to the device Management Console, then Navigate to: Configure >> System Settings >> Logging Under Configuration, set minimum severity to Info Click "Save" Under Configuration, set minimum severity to Info.

Additional Identifiers

Rule ID: SV-255443r960783_rule

Vulnerability ID: V-255443

Group Title: SRG-APP-000028-NDM-000210

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.