OpenControls Logo

STIG Viewer

STIGViewer Support

The F5 BIG-IP appliance must be configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-266064F5BI-DM-300001SV-266064r1024595_ruleCCI-000054medium
Description
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. Satisfies: SRG-APP-000001-NDM-000200, SRG-APP-000435-NDM-000315
STIGDate
F5 BIG-IP TMOS NDM Security Technical Implementation Guide2025-06-12

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

HRS-02Position Categorization
1.00
HRS-11Separation of Duties (SoD)
1.00
IAC-01Identity & Access Management (IAM)
1.00
IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
IAC-08Role-Based Access Control (RBAC)
1.00
IAC-21Least Privilege
1.00

+14 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (59) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+49 more (top 10 by confidence shown)

CCI2 mappings
CCI-000054
1.00
CCI-002385
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.AA-05
1.00
PR.IR-01
1.00
PR.IR-04
0.50

Who does this work

16 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-266064r1024595_chk)

From the BIG-IP GUI: 1. System. 2. Preferences. 3. Verify that System Settings view is set to Advanced. 4. Verify Maximum HTTP connections to Configuration Utility is set to 10 or an organization-defined number. From the BIG-IP console, type the following command: tmsh list sys httpd max-clients If the device is not configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number, this is a finding.

Fix Text (F-69890r1023442_fix)

From the BIG-IP GUI: 1. System. 2. Preferences. 3. Set System Settings view to Advanced. 4. Maximum HTTP connections to Configuration Utility: enter 10 or an organization-defined number. 5. Update. From the BIG-IP console, type the following commands: tmsh modify sys httpd max-clients <10 or an organization-defined number> tmsh save sys config