Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-40195 | WIN00-000013 | SV-55006r1_rule | ECLP-1 | Medium |
Description |
---|
A system's BIOS or system controller handles the initial startup of a system, and its configuration must be protected from unauthorized modification. When the BIOS or system controller supports the creation of user accounts or passwords, such protections must be used and accounts/passwords only assigned to system administrators. Failure to protect BIOS or system controller settings could result in Denial of Service or compromise of the system resulting from unauthorized configuration changes. |
STIG | Date |
---|---|
Windows 2008 Member Server Security Technical Implementation Guide | 2015-06-03 |
Check Text ( C-48736r1_chk ) |
---|
If the BIOS or system controller does not support user-level access in addition to supervisor/administrator access, this is NA. If the BIOS or system controller supports user-level access in addition to supervisor/administrator access, determine whether this access is enabled. If user-level access is enabled, this is a finding. |
Fix Text (F-47885r1_fix) |
---|
Access the system's BIOS or system controller. Disable user-level access. |