V2R1 changes
HPE Nimble Storage Array NDM STIG V2R1 (2024-07-24) replaced V1R2 (2024-01-24): 1 check removed, 9 updated. It has 20 checks, against 21 in V1R2.
V2R1 checklistV1R2 checklist Compare V1R2 and V2R1 in STIG Compare
- 0 added
- 1 removed
- 9 updated
Updated fields: CCIs 8Check text 6Title 2Discussion 2Fix text 1
Removed since V1R2 (1)
- V-252189CAT IIThe HPE Nimble must not have any default manufacturer passwords when deployed.
Updated in V2R1 (9)
V-252190CAT IIThe HPE Nimble must enforce a minimum 15-character password length.Check text, CCIs
Check text
Type "userpolicy --info" and review output for line: "Minimum Length".
If it is 15 or more, this is not a finding.
CCIs
CCI-004020566
V-252191CAT IIThe HPE Nimble must enforce password complexity by requiring that at least one uppercase character be used.Title, Check text, CCIs
Title
The HPE Nimble must enforce password complexity by requiring that at least one upper-case character be used.
Check text
Type "userpolicy --info" and review output for line: "Minimum Uppercase characters".
If it is 1 or more, this is not a finding.
CCIs
CCI-004019266
V-252192CAT IIThe HPE Nimble must enforce password complexity by requiring that at least one lowercase character be used.Title, Check text, CCIs
Title
The HPE Nimble must enforce password complexity by requiring that at least one lower-case character be used.
Check text
Type "userpolicy --info" and review output for line: "Minimum Lowercase characters".
If it is 1 or more, this is not a finding.
CCIs
CCI-004019366
V-252193CAT IIThe HPE Nimble must enforce password complexity by requiring that at least one numeric character be used.CCIs
V-252194CAT IIThe HPE Nimble must enforce password complexity by requiring that at least one special character be used.Check text, CCIs
Check text
Type "userpolicy --info" and review output for line: "Minimum Special characters". If it is 1 or more, this is not a finding.
CCIs
CCI-001406196
V-252195CAT IIThe HPE Nimble must require that when a password is changed, the characters are changed in at least eight of the positions within the password.Check text, CCIs
Check text
Type "userpolicy --info" and review output for line: "Minimum number of characters change from previous password". If it is 8 or more, this is not a finding.
CCIs
CCI-004019566
V-252197CAT IThe HPE Nimble must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.Check text
Check text
Run the command "userauth --list". If the output is "No domains configured", this is a finding.
V-252198CAT IIThe HPE Nimble must obtain its public key certificates from an appropriate certificate policy through an approved service provider.Fix text, Discussion, CCIs
Fix text
To create and import a custom, CA-signed certificate, follow these steps: 1. Type "cert --gen custom-csr". Copy the displayed CSR and submit it to an appropriate signing authority. 2. Type "cert --import custom-ca" and paste the PEM-encoded CA certificate chain as input to the command. 3. Type "cert --import custom" and paste the signed certificate obtained from the CA.
Discussion
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority (CA) will suffice.
CCIs
CCI-000366,CCI-001159,CCI-004068
V-252202CAT IIThe HPE Nimble must be configured to synchronize internal information system clocks using an authoritative time source.Discussion, CCIs
Discussion
The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions.
Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes its time to a more accurate source. The network device must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891.
DoDDOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DoDDOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.
CCIs
CCI-000366,CCI-0014928,CCI-0049322
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.