Title

The VMM must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. (Cat II impact)

Discussion

Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD common access card. A privileged account is defined as a VMM account with authorizations of a privileged user. Remote access is access to DOD nonpublic VMMs by an authorized user (or a VMM) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Check Content

Verify the VMM implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. If it does not, this is a finding.

Fix Text

Configure the VMM to implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Additional Identifiers

Rule ID: SV-207480r984255_rule

Vulnerability ID: V-207480

Group Title: SRG-OS-000375

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.