OpenControls Logo

STIG Viewer

STIGViewer Support

SSMC must be configured to offload logs to a SIEM that is configured to alert the ISSO or SA when the local built-in admin account (ssmcadmin) is accessed.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-255243SSMC-OS-010100SV-255243r991589_ruleCCI-002664medium
Description
Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DOD that reflects the most restrictive security posture consistent with operational requirements. The ssmcadmin account is an emergency group account used to administer ssmc. This is a privileged account that can Log on to the SSMC appliance. The ssmcaudit account is a nonprivileged group user account that can be enabled/disabled by ssmcadmin for CVE scanning via TUI. This is the other group account that can log on to the appliance. By alerting to the use of ssmcadmin account, the information assurance team can mitigate the risks involved in using this group account. These alerts must be used to ensure that the use of this account is warranted and documented.
STIGDate
HPE 3PAR SSMC Operating System Security Technical Implementation Guide2024-08-27

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01.4System Generated Alerts
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
SC-7(9)Restrict Threatening Outgoing Communications Traffic
1.00
SI-3Malicious Code Protection
1.00
SI-4(1)System-wide Intrusion Detection System
1.00
SI-4(22)Unauthorized Network Services
1.00
SI-4(5)System-generated Alerts
1.00
CCI1 mapping
CCI-002664
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.PS-04
1.00

Details

Check Text (C-255243r991589_chk)

Verify that SSMC is configured to offload logs to a SIEM that is set up to alert the ISSO or SA when the ssmcadmin account is accessed by performing the following: 1. Log on to SIEM where the logs are being offloaded. 2. Log on to SSMC with the ssmcadmin account. 3. Return to the SIEM to see that an alert has been generated based on the access of the ssmcadmin account. If the SIEM does not generate an alert for the ISSO or SA, this is a finding.

Fix Text (F-58800r869878_fix)

Configure SSMC to offload logs to a SIEM that is set up to alert the ISSO or SA when the ssmcadmin account is accessed by performing the following: 1. Implement SSMC-WS-010080 to establish offloading logs to a SIEM. 2. Configure the SIEM to alert the ISSO or SA in the event that the ssmcadmin account is accessed.