Title

Administrative password is not configured for Desktop Units. (Cat II impact)

Discussion

From a physical security perspective, the DTU pop-menu is accessible, therefore a username/password or administrative only password is recommended to protect the device from unauthorized changes made locally.

Check Content

On the Sun Ray 2fs unit press the (Stop-M) on Sun Keyboard and on the PC keyboards press the (Ctrl-Pause-M or S). If you are not prompted for a password to enter the firmware configuration, this is a finding. To configure the password, select Security, Password, and type in the password. Make sure it is compliant with DoD password policies. Caveat: If the (Stop-M) on the Sun keyboard or the (Ctrl-Pause-M or S) on the PC keyboards does not bring up the pop-up firmware-gui, then the pop-up function is disabled for this firmware and this is not applicable. Note: For other Sun Ray Desktop Units, consult the system administrator or documentation for the key mode combinations.

Fix Text

Configure a username / password for the DTU pop-up menu.

Additional Identifiers

Rule ID:

Vulnerability ID: V-16351

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.