What changed in HP FlexFabric Switch NDM STIG V1R5V1R5 changes

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoDDoW-approved PKIs, all DoDDoW systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the HP FlexFabric Switch to control access between administrators (or processes acting on behalf of administrators) and objects (e.g., device commands, files, records, processes) in the HP FlexFabric Switch.

V-217431 in V1R5

Title

The HP FlexFabric Switch must display the Standard Mandatory DoDW Notice and Consent Banner before granting access to the device.

Check text

Determine if the HP FlexFabric Switch is configured to present a DoDDoW-approved banner that is formatted in accordance with DTM-08-060. Establish a console or vty connection to HP FlexFabric Switch and attempt to logon to it. Once entering the username the banner should appear: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." If such a banner is not presented, this is a finding.

Fix text

Configure the HP FlexFabric Switch to display the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the switch. [HP] header legal % Desirable text goes here % Note: In this example, the percentage sign (%) is the starting and ending character of the text argument. Entering the percentage sign after the text quits the header command. Because it is the starting and ending character, the percentage sign is not included in the banner.

Discussion

Display of the DoDDoW-approved use notification before granting access to the HP FlexFabric Switch ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users.

V-217434 in V1R5

Title

The HP FlexFabric Switch must retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.

Check text

Determine if the HP FlexFabric Switch is configured to retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access. After entering the username and password for HP FlexFabric Switch the banner and acknowledgement of the notice should be displayed: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." Press Y or ENTER to continue, N to exit. If HP FlexFabric Switch does not retain the banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to logon for further access, this is a finding.

Fix text

Configure the HP FlexFabric Switch to display the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the switch. [HP] header legal % Desirable text goes here % Note: In this example, the percentage sign (%) is the starting and ending character of the text argument. Entering the percentage sign after the text quits the header command. Because it is the starting and ending character, the percentage sign is not included in the banner.

Discussion

The banner must be acknowledged by the administrator prior to allowing the administrator access to the HP FlexFabric Switch. This provides assurance that the administrator has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the administrator, DoDDoW will not be in compliance with system use notifications required by law. To establish acceptance of the network administration policy, a click-through banner at management session logon is required. The device must prevent further activity until the administrator executes a positive action to manifest agreement by clicking on a box indicating "OK".

V-217435 in V1R5

Check text

Determine if the HP FlexFabric Switch or its associated authentication server enforces a minimum 15-character password length. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) If the HP FlexFabric Switch does not have password control enabled and does not enforce a minimum 15-character password length, this is a finding.

V-217452 in V1R5

Check text

Check to see that the HP FlexFabric Switch enforces password complexity by requiring that at least one uppercase character be used. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (4 types, 1 characters per type) If the HP FlexFabric Switch does not have password control enabled and does not require that at least one uppercase character be used in each password, this is a finding.

V-217453 in V1R5

Check text

Check to see that the HP FlexFabric Switch enforces password complexity by requiring that at least one lowercase character be used. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (4 types, 1 characters per type) If the HP FlexFabric Switch does not have password control enabled and does not require that at least one lowercase character be used in each password, this is a finding.

V-217454 in V1R5

Check text

Check to see that the HP FlexFabric Switch enforces password complexity by requiring that at least one numeric character be used. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (4 types, 1 characters per type) If the HP FlexFabric Switch does not have password control enabled and does not require that at least one numeric character be used in each password, this is a finding.

V-217455 in V1R5

Check text

Check to see that the HP FlexFabric Switch enforces password complexity by requiring that at least one special character be used. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (4 types, 1 characters per type) If the HP FlexFabric Switch does not have password control enabled and does not require that at least one special character be used in each password, this is a finding.

V-217456 in V1R5

Discussion

The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes its time to a more accurate source. The HP FlexFabric Switch must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891. DoDDoW-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DoDDoW network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

V-217465 in V1R5

Discussion

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of network devices to mitigate the impact of DoS attacks that have occurred or are ongoing on device availability. For each network device, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the device opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks. The security safeguards cannot be defined at the DoDDoW level because they vary according to the capabilities of the individual network devices and the security controls applied on the adjacent networks (for example, firewalls performing packet filtering to block DoS attacks).

V-217470 in V1R5

Title

The HP FlexFabric Switch must provide audit record generation capability for DoDW-defined auditable events within the HP FlexFabric Switch.

Check text

Determine if the HP FlexFabric Switch provides audit record generation capability for DoDDoW-defined auditable events within the HP FlexFabric Switch. The list of events for which the device will provide an audit record generation capability is outlined in the vulnerability discussion. [HP] display security-logfile summary summary Display summary information of the security log file Security log file: Disabled Security log file size quota: 10 MB Security log file directory: cfa0:/seclog Alarm threshold: 80% Current usage: 0% Writing frequency: 24 hour 0 min 0 sec If the HP FlexFabric Switch does not provide audit record generation capability for DoDDoW-defined auditable events within the HP FlexFabric Switch, this is a finding.

Fix text

Configure the HP FlexFabric Switch to provide audit record generation capability for DoDDoW-defined auditable events within the HP FlexFabric Switch. [HP] info-center security-logfile enable [HP] info-center security-logfile frequency 30 (in seconds) [HP] info-center security-logfile size-quota 5 (in MB) [HP] info-center security-logfile alarm-threshold 90 (in %)

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the HP FlexFabric Switch (e.g., process, module). Certain specific device functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which the device will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions.

V-230164 in V1R5

Check text

Determine if the HP FlexFabric Switch prohibits password reuse for a minimum of five generations. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (1 types, 1 characters per type) Password history: Enabled (max history records: 4) If the HP FlexFabric Switch does not have password control enabled and does not prohibit password reuse for a minimum of five generations, this is a finding.

V-230167 in V1R5

Check text

Determine if the HP FlexFabric Switch enforces 24 hours/1one day as the minimum password lifetime. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) Password length: Enabled (15 characters) Password composition: Enabled (1 types, 1 characters per type) Password history: Enabled (max history records: 4) Early notice on password expiration: 7 days Maximum login attempts: 3 Action for exceeding login attempts: Lock user for 1 minutes Minimum interval between two updates: 24 hours If the HP FlexFabric Switch does not have password control enabled and does not enforce 24 hours/1one day as the minimum password lifetime, this is a finding.

V-230168 in V1R5

Title

The HP FlexFabric Switch must enforce a 6180-day maximum password lifetime restriction.

Check text

Determine if the HP FlexFabric Switch enforces a 60180-day maximum password lifetime. [HP] display password-control Global password control configurations: Password control: Enabled Password aging: Enabled (60180 days) If the HP FlexFabric Switch does not have password control enabled and does not enforce a 60180-day maximum password lifetime, this is a finding.

Fix text

Configure the HP FlexFabric Switch to enforce a 6180-day maximum password lifetime. [HP]password-control enable [HP]password-control aging 6180

V-230169 in V1R5