What changed in AAA Services Security Requirements Guide V2R3V2R3 changes

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which the application will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions.

V-204645 in V2R3

Title

AAA Services must be configured to require multifactor authentication using Commoncommon Accessaccess Cardcard (CAC) Personal Identity Verification (PIV) credentials for authenticating non-privilegednonprivileged user accounts.

Discussion

To assureensure accountability and prevent unauthenticated access, non-privilegednonprivileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A non-privilegednonprivileged account is any information system account with authorizations of a non-privilegednonprivileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection. Applications integrating with the DoDDoW Active Directory and using the DoDDoW CAC are examples of compliant multifactor authentication solutions.

V-204662 in V2R3

Title

AAA Services must be configured to enforce a 6180-day maximum password lifetime restriction.

Check text

If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort. Where passwords are used, such as temporary or emergency accounts, verify AAA Services are configured to enforce a 60180-day maximum password lifetime restriction. Additionally, AAA Services must force password change upon the first logon after the expiration of the 60180 days. If AAA Services are not configured to enforce a 60180-day maximum password lifetime restriction, this is a finding.

Fix text

Configure AAA Services to enforce a 60180-day maximum password lifetime restriction. Additionally, configure AAA Services to force password change upon the first logon after the expiration of the 60180 days. This requirement is not applicable to service account passwords (e.g. shared secrets, pre-shared keys) or the account of last resort.

V-204674 in V2R3

Title

AAA Services must be configured to only accept certificates issued by a DoDDoW-approved Certificatecertificate Authorityauthority (CA) for Public Key Infrastructure (PKI)-based authentication.

Check text

Verify AAA Services are configured to only accept certificates issued by a DoDDoW-approved CertificateCA Authority for PKI-based authentication. If AAA Services are not configured to only accept certificates issued by a DoDDoW-approved Certificate AuthorityCA, this is a finding.

Fix text

Configure AAA Services to only accept certificates issued by a DoDW-approved Certificate Authority for PKI-based authentication.

V-204675 in V2R3

Discussion

Additional new EAP methods/types are still being proposed. However, the three being considered secure are EAP-TLS, EAP-TTLS, and PEAP. PEAP is the preferred EAP type to be used in DoDDoW for its ability to support a greater number of operating systems and its capability to transmit statement of health information, per NSA NAC study. Lightweight EAP (LEAP) is a CISCO proprietary protocol providing an easy-to-deploy one-password authentication. LEAP is vulnerable to dictionary attacks. A "man in the middle" can capture traffic, identify a password, and then use it to access a WLAN. LEAP is inappropriate and does not provide sufficient security for use on DODDoW networks. EAP-MD5 is functionally similar to CHAP and is susceptible to eavesdropping because the password credentials are sent as a hash (not encrypted). In addition, server administrators would be required to store unencrypted passwords on their servers violating other security policies. EAP-MD5 is inappropriate and does not provide sufficient security for use on DODDoW networks.

V-204698 in V2R3

Title

AAA Services must be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Check text

Determine if AAA Services are configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. If AAA Services are not configured in accordance with the designated security configuration settings, this is a finding.

Fix text

Configure the network device to be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Discussion

Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoDDoW that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.

V-204704 in V2R3