What changed in IBM Hardware Management Console (HMC) STIG V2R2V2R2 changes

Title

The PASSWORD expiration day(s) value must be set to equal or less thean 6180 days.

Check text

Have the system administrator (SA) display the Password Profile Task window on the Hardware Management Console and validate that the Expiration day(s) is set to equal or less than 60180 days. If the expiration day(s) is set to equal or less thenthan 60180 days, this is not a finding. If the expiration day(s) is greater than 60180 days, then this is a finding.

Fix text

Have the SA go into the Password Profile and set the Expiration day(s) to equal or less thean 6180 days.

V-256879 in V2R2

Title

The password values must be set to meet the requirements in accordance with DODI 8500.2 for DoDDoW information systems processing sensitive information and above, and CJCSI 6510.01E (INFORMATION ASSURANCE [IA] AND COMPUTER NETWORK DEFENSE [CND]).

Discussion

In accordance with DODI 8500.2 for DODDoW information systems processing sensitive information and above and CJCSI 6510.01E (INFORMATION ASSURANCE [IA] AND COMPUTER NETWORK DEFENSE [CND]). The following recommendations concerning password requirements are mandatory and apply equally to both classified and unclassified systems: (1) Passwords are to be 14 characters. (2) Passwords are to be a mix of uppercase, lowercase alphabetic, numeric, and special characters, including at least one of each. Special characters include the national characters (i.e., @, #, and $) and other nonalphabetic and nonnumeric characters typically found on a keyboard. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the Hardware Management Console control options introduces the possibility of exposure during the migration process or contingency plan activation.

V-256882 in V2R2

Title

The Department ofW Defense (DoD) logon banner must be displayed prior to any login attempt.

Check text

Have the reviewer verify that the logon banner reads as follows:on the Create Welcome Text window: STANDARD MANDATORY DODDoW NOTICE AND CONSENT BANNER You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. If any item in above is untrue, this is a FINDINGfinding.

Fix text

The SystemSA Administrator will update the logon banner by going to the Create Welcome Text Task to read as follows: STANDARD MANDATORY DODDoW NOTICE AND CONSENT BANNER You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Discussion

Failure to display the required DoDDoW logon banner prior to a login attempt may void legal proceedings resulting from unauthorized access to system resources and may leave the system administrator (SA), IAOinformation system security officer (ISSO), IAMinformation system security manager (ISSM), and Installation Commander open to legal proceedings for not advising users that keystrokes are being audited.

V-256884 in V2R2

Title

A private web server must subscribe to certificates, issued from any DODoW-authorized Certificate Authority (CA), as an access control mechanism for web users.

Check text

The Systemsystem Reviewerreviewer will have the system administrator (SA) use the HardwareHMC Management Console Certificate Management Task to validate that the private key and certificate shipped with any network-connected HMC from IBM was replaced with an approved DODDoW-authorized Certificate. Note: This check applies only to network-connected HMCs. Note: DODDoW certificates should display the following Information: 'OU=PKI.OU=DoDDoW.O=U.S. Government.C=US' If private web server does not subscribe to certificates issued from any DODDoW-authorized Certificate Authority (CA) as an access control mechanism for web users, this is a finding.

Fix text

The SA must order a DODDoW PKI to replace the IBM Certificate and then use the Hardware Management Console Certificate Management Task to install it. Note: This only applies to networked HMCs.

Discussion

If the Hardware Management Consoles (HMC) is network- connected, use SSL encryption techniques, through digital certificates to provide message privacy, message integrity, and mutual authentication between clients and servers. To maintain data integrity, the IBM Certificate distributed with the HMC's is to be replaced by a DODDoW-authorized Certificate. Note: This check applies only to network-connected HMCs.

V-256885 in V2R2