What changed in A10 Networks ADC NDM STIG V1R2V1R2 changes

A10 Networks ADC NDM STIG V1R2 (2024-07-24) replaced V1R1 (2016-04-15): 38 checks added, 37 removed. It has 38 checks, against 37 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 38 added
  • 37 removed
  • 0 updated

Added in V1R2 (38)

  • V-255587CAT IIThe A10 Networks ADC must limit the number of concurrent sessions to one (1) for each administrator account and/or administrator account type.
  • V-255588CAT IIThe A10 Networks ADC must enforce the limit of three consecutive invalid logon attempts.
  • V-255589CAT IIIThe A10 Networks ADC must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
  • V-255590CAT IIThe A10 Networks ADC must allow only the ISSM (or individuals or roles appointed by the ISSM) Root, Read Write, or Read Only privileges.
  • V-255591CAT IIIThe A10 Networks ADC must produce audit log records containing information (FQDN, unique hostname, management or loopback IP address) to establish the source of events.
  • V-255592CAT IIIThe A10 Networks ADC must have command auditing enabled.
  • V-255593CAT IIIThe A10 Networks ADC must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
  • V-255594CAT IIIThe A10 Networks ADC must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-255595CAT IIThe A10 Networks ADC must disable management protocol access to all interfaces except the management interface.
  • V-255596CAT IIThe A10 Networks ADC must not have any shared accounts (other than the emergency administration account).
  • V-255597CAT IThe A10 Networks ADC must not use the default admin account.
  • V-255598CAT IIThe A10 Networks ADC must implement replay-resistant authentication mechanisms for network access to privileged accounts.
  • V-255599CAT IIThe A10 Networks ADC must prohibit the use of unencrypted protocols for network access to privileged accounts.
  • V-255600CAT IThe A10 Networks ADC must terminate management sessions after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-255601CAT IIThe A10 Networks ADC must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
  • V-255602CAT IThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are created.
  • V-255603CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are modified.
  • V-255604CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are disabled.
  • V-255605CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are removed.
  • V-255606CAT IIWhen anyone who has access to the emergency administration account no longer requires access to it or leaves the organization, the password for the emergency administration account must be changed.
  • V-255607CAT IIThe A10 Networks ADC must notify System Administrators (SAs) and Information System Security Officers (ISSMs) when accounts are created, or enabled when previously disabled.
  • V-255608CAT IIThe A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
  • V-255609CAT IIIThe A10 Networks ADC must send Emergency messages to the Console, Syslog, and Monitor.
  • V-255610CAT IIIThe A10 Networks ADC must compare internal information system clocks at least every 24 hours with an authoritative time server.
  • V-255611CAT IIIThe A10 Networks ADC must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
  • V-255612CAT IIThe A10 Networks ADC must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.
  • V-255613CAT IIThe A10 Networks ADC must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-255614CAT IIThe A10 Networks ADC must authenticate Network Time Protocol sources.
  • V-255615CAT IIOperators of the A10 Networks ADC must not use the Telnet client built into the device.
  • V-255616CAT IThe A10 Networks ADC must not use SNMP Versions 1 or 2.
  • V-255617CAT IIThe A10 Networks ADC must off-load audit records onto a different system or media than the system being audited.
  • V-255618CAT IIThe A10 Networks ADC must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and IAW CJCSM 6510.01B.
  • V-255619CAT IIThe A10 Networks ADC must employ centrally managed authentication server(s).
  • V-255620CAT IIThe A10 Networks ADC must use DoD-approved PKI rather than proprietary or self-signed device certificates.
  • V-255621CAT IIThe A10 Networks ADC must restrict management connections to the management network.
  • V-255622CAT IIThe A10 Networks ADC must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.
  • V-255623CAT IThe A10 Networks ADC must not use the default enable password.
  • V-264426CAT IThe A10 Networks NDM must be using a version supported by the vendor.

Removed since V1R1 (37)

  • V-68031CAT IIThe A10 Networks ADC must limit the number of concurrent sessions to one (1) for each administrator account and/or administrator account type.
  • V-68033CAT IIThe A10 Networks ADC must enforce the limit of three consecutive invalid logon attempts.
  • V-68035CAT IIIThe A10 Networks ADC must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
  • V-68037CAT IIThe A10 Networks ADC must allow only the ISSM (or individuals or roles appointed by the ISSM) Root, Read Write, or Read Only privileges.
  • V-68039CAT IIIThe A10 Networks ADC must produce audit log records containing information (FQDN, unique hostname, management or loopback IP address) to establish the source of events.
  • V-68041CAT IIIThe A10 Networks ADC must have command auditing enabled.
  • V-68043CAT IIIThe A10 Networks ADC must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
  • V-68045CAT IIIThe A10 Networks ADC must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-68047CAT IIThe A10 Networks ADC must disable management protocol access to all interfaces except the management interface.
  • V-68049CAT IIThe A10 Networks ADC must not have any shared accounts (other than the emergency administration account).
  • V-68051CAT IThe A10 Networks ADC must not use the default admin account.
  • V-68053CAT IIThe A10 Networks ADC must implement replay-resistant authentication mechanisms for network access to privileged accounts.
  • V-68055CAT IIThe A10 Networks ADC must prohibit the use of unencrypted protocols for network access to privileged accounts.
  • V-68057CAT IThe A10 Networks ADC must terminate management sessions after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-68059CAT IIThe A10 Networks ADC must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
  • V-68061CAT IThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are created.
  • V-68063CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are modified.
  • V-68065CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are disabled.
  • V-68067CAT IIThe A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are removed.
  • V-68069CAT IIWhen anyone who has access to the emergency administration account no longer requires access to it or leaves the organization, the password for the emergency administration account must be changed.
  • V-68071CAT IIThe A10 Networks ADC must notify System Administrators (SAs) and Information System Security Officers (ISSMs) when accounts are created, or enabled when previously disabled.
  • V-68073CAT IIThe A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
  • V-68075CAT IIIThe A10 Networks ADC must send Emergency messages to the Console, Syslog, and Monitor.
  • V-68077CAT IIIThe A10 Networks ADC must compare internal information system clocks at least every 24 hours with an authoritative time server.
  • V-68079CAT IIIThe A10 Networks ADC must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
  • V-68081CAT IIThe A10 Networks ADC must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.
  • V-68083CAT IIThe A10 Networks ADC must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-68085CAT IIThe A10 Networks ADC must authenticate Network Time Protocol sources.
  • V-68087CAT IIOperators of the A10 Networks ADC must not use the Telnet client built into the device.
  • V-68089CAT IThe A10 Networks ADC must not use SNMP Versions 1 or 2.
  • V-68091CAT IIThe A10 Networks ADC must off-load audit records onto a different system or media than the system being audited.
  • V-68093CAT IThe A10 Networks ADC must not use the default enable password.
  • V-68095CAT IIThe A10 Networks ADC must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.
  • V-68097CAT IIThe A10 Networks ADC must restrict management connections to the management network.
  • V-68099CAT IIThe A10 Networks ADC must use DoD-approved PKI rather than proprietary or self-signed device certificates.
  • V-68101CAT IIThe A10 Networks ADC must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and IAW CJCSM 6510.01B.
  • V-68103CAT IIThe A10 Networks ADC must employ centrally managed authentication server(s).

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.