The Riverbed NetProfiler must be configured to limit the number of concurrent sessions to one for the locally defined administrator account.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256071 | RINP-DM-000001 | SV-256071r960735_rule | CCI-000054 | low |
| Description | ||||
| Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DOS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions. | ||||
| STIG | Date | |||
| Riverbed NetProfiler Security Technical Implementation Guide | 2024-08-27 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
AC-10
1.00
- DISA · V2R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-000054
1.00
- DISA · V2R1 · disa_xccdf · related
Details
Check Text (C-256071r960735_chk)
Go to Administration >> Account Management >> User Accounts.
Click "Settings".
Check under "Log-in Settings".
If the "Allow only one log-in per user name/password combination" box is not checked, this is a finding.
Fix Text (F-59688r882720_fix)
Go to Administration >> Account Management >> User Accounts.
Click "Settings".
Under "Log-in Settings", check the "Allow only one log-in per user name/password combination" box.
Click "OK" to save the settings.