Title

System BIOS or system controllers must not allow user-level access. (Cat II impact)

Discussion

A system's BIOS or system controller handles the initial startup of a system, and its configuration must be protected from unauthorized modification. When the BIOS or system controller supports the creation of user accounts or passwords, such protections must be used and accounts/passwords only assigned to system administrators. Failure to protect BIOS or system controller settings could result in Denial of Service or compromise of the system resulting from unauthorized configuration changes.

Check Content

If the BIOS or system controller does not support user-level access in addition to supervisor/administrator access, this is NA. If the BIOS or system controller supports user-level access in addition to supervisor/administrator access, determine whether this access is enabled. If user-level access is enabled, this is a finding.

Fix Text

Access the system's BIOS or system controller. Disable user-level access.

Additional Identifiers

Rule ID: SV-55001r1_rule

Vulnerability ID: V-40195

Group Title: WN00-000002-02

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.