OpenControls Logo

STIG Viewer

STIGViewer Support

Symantec ProxySG must employ automated mechanisms to centrally verify authentication settings.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-94681SYMP-NM-000150SV-104511r1_ruleCCI-000366medium
Description
The use of authentication servers or other centralized management servers for providing centralized authentication services is required for network device management. Maintaining local administrator accounts for daily usage on each network device without centralized management is not scalable or feasible. Without centralized management, it is likely that credentials for some network devices will be forgotten, leading to delays in administration, which itself leads to delays in remediating production problems and in addressing compromises in a timely fashion.
STIGDate
Symantec ProxySG NDM Security Technical Implementation Guide2019-12-20

Related Frameworks

2 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.2Automated Central Management & Verification
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI2 mappings
CCI-000366
1.00
CCI-000372
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-104511r1_chk)

Verify a AAA server is used for access by system administrators as required in DoD. 1. Log on to the Web Management Console. 2. Click Configuration >> Authentication >> RADIUS. 3. Confirm that a RADIUS realm has been configured. 4. Click Configuration >> Policy >> Visual Policy Manager. 5. Click "Launch", select the "Admin Authentication" layer. 6. Confirm the "Action" in each rule references the RADIUS realm in step 3. If Symantec ProxySG does not employ automated mechanisms to centrally verify authentication settings, this is a finding.

Fix Text (F-100799r1_fix)

Configure the Symantec ProxySG to use a centrally administered AAA server. 1. Log on to the Web Management Console. 2. Click Configuration >> Authentication >> RADIUS. 3. Click "New" then enter a Realm name. 4. Under "Realm configuration" enter the IP address for the primary RADIUS server and modify port (if necessary). 5. Enter a Secret pre-shared key, and enter the same Secret pre-shred key for confirmation, click "OK". 6. Click Radius Servers. 7. Enter an IP address for the Alternate Server and modify port (if necessary). 8. Click "Apply". 9. Click Configuration >> Policy >> Visual Policy Manager. 10. Click "Launch", select the "Admin Authentication" layer. 11. Right-click the "Action" in each rule and click "Set". 12. Click "New", then "Authenticate", and choose the RADIUS realm configured in step 3. 13. Click "File", click "Install Policy on SG Appliance".