DocAve must use multifactor authentication for network access to privileged accounts.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253515 | DCAV-00-000056 | SV-253515r836520_rule | CCI-000765 | high |
| Description | ||||
| Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). Multifactor authentication decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user's password to obtain access. A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). | ||||
| STIG | Date | |||
| AvePoint DocAve 6 Security Technical Implementation Guide | 2022-08-24 | |||
Details
Check Text (C-253515r836520_chk)
DocAve supports Client Certificate Authentication for multi-factor authentication, which requires both Windows Authentication and Client Certificate Authentication enabled in DocAve. Settings must be configured in IIS and DocAve. The IIS configuration under DCAV-00-000057 should be performed first.
Check the DocAve Client Certificate Authentication configuration.
- Log on to DocAve with admin account.
- On the Control Panel page, in the Authentication Manager section, click "Authentication Manager".
- Verify that "Client Certificate Authentication" is enabled.
If "Client Certificate Authentication" is not enabled, this is a finding.
Check the DocAve Windows Authentication configuration.
- Log on to DocAve with admin account.
- On the Control Panel page, in the Authentication Manager section, click "Authentication Manager".
- Verify that "Windows Authentication" is enabled.
If "Windows Authentication" is not enabled, this is a finding.
Fix Text (F-56918r836519_fix)
Configure DocAve to use Smart Card Authentication. Settings must be configured in IIS and DocAve. The IIS configuration under DCAV-00-000057 should be performed first.
Log on to DocAve with admin account.
- On the Control Panel page, in the Authentication Manager section, click "Authentication Manager".
- Click "Enable" in the Action column of the Client Certificate Authentication row to enable client certificate authentication.
- Click "Enable" in the Action column of the Windows Authentication row to enable Windows Authentication.
- Back to the Control Panel page, in the Account Manager section, click "Account Manager".
- Click "Users-Add User".
- Select Client Certificate User from the drop-down list in the "What kind of user would you like to add?" field.
- Specify the user in the Windows User/Group Name field.
- Add this user to one or more DocAve groups.
- Save the settings.