OpenControls Logo

STIG Viewer

STIGViewer Support

The Central Log Server must be configured to use multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-206464SRG-APP-000154-AU-002360SV-206464r981726_ruleCCI-004046medium
Description
Using an authentication device, such as a DOD common access card (CAC) or token separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards, such as the U.S. Government Personal Identity Verification card and the DOD CAC. A privileged account is any information system account with authorizations of a privileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.
STIGDate
Central Log Server Security Requirements Guide2024-12-04

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-06.4Out-of-Band Multi-Factor Authentication
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (60) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+50 more (top 10 by confidence shown)

CCI1 mapping
CCI-004046
1.00

Details

Check Text (C-206464r981726_chk)

Examine the configuration. Verify the Central Log Server is configured to use DOD PKI or another form of multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. If the Central Log Server is not configured to use multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix Text (F-6724r981725_fix)

This requirement applies to all privileged user accounts used for network logon to the application. Configure the Central Log Server to use DOD PKI or another form of multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.