What changed in Nutanix Acropolis Application Server STIG V1R2V1R2 changes

Check text

Verify the Signing Algorithm of the current TLS certificate. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to "SSL Certificate". If there is no DODDoW TLS certificate loaded, this is a finding.

Fix text

Import a DODDoW PKI-issued TLS certificate. 1. Click the gear icon in the upper-right corner. 2. Navigate to "SSL Certificate". 3. Select the option to import certificate and follow the prompts.

V-279418 in V1R2

Title

Nutanix AOS server management interface must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system.

Check text

Verify the Prism WebUI "Welcome Banner" is enabled. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the "Welcome Banner". 4. Verify the "Enable Banner" box is selected. If the "Enable Banner" box is not checked, this is a finding. Confirm the Nutanix AOS Prism WebUI is set to display the Standard Mandatory DODDoW Notice and Consent Banner. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the "Welcome Banner" and enter the following text exactly as presented below. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. If the Welcome Banner is not configured with the Standard Mandatory DODDoW Notice and Consent Banner, this is a finding.

Fix text

Configure the Nutanix AOS Prism Element WebUI to display the Standard Mandatory DODDoW Notice and Consent Banner. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the "Welcome Banner". 4. Set the Welcome Banner to use the DODDoW banner text below. 5. Check "Enable Banner". 6. Click "Save". Standard Mandatory DODDoW Notice and Consent Banner: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Discussion

Application servers are required to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system management interface, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) using the system indicates consent to monitoring and recording. System use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system. System use notification is intended only for information system access including an interactive logon interface with a human user and is not required when an interactive interface does not exist. Use this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner must be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-APP-000068-AS-000035, SRG-APP-000069-AS-000036

V-279422 in V1R2

Check text

Verify the Nutanix AOS uses a centralized AAA server that uses DODDoW PKI to authenticate individual users. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the Authentication settings. If CAC authentication is not enabled, this is a finding.

Fix text

Configure the Nutanix AOS to use a centralized AAA server that uses DODDoW PKI to authenticate individual users. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the Authentication settings. 4. Select the "Configure Service Account" check box and then complete the following in the indicated fields: a. Select the authentication directory that contains the CAC users to be authenticated. This list includes the directories configured on the Directory List tab. b. Service Username: Enter the username in the username@domain.com format the web console will use to log in to the Active Directory. c. Service Password: Enter the password for the service username. d. Click "Enable CAC".

V-279434 in V1R2

Title

Nutanix AOS must be configured to use DODoW PKI-issued certificates.

Check text

Confirm the Nutanix VM application server is configured with a trusted DODDoW root CA-signed certificate. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the SSL Certificate section. 4. Ensure the approved CA signed certificate is installed. If the certificate used is not from an approved DODDoW-approved CA, this is a finding.

Fix text

Configure the Nutanix VM application server to use a trusted DODDoW root CA-signed certificate. 1. Log in to Prism Element. 2. Click the gear icon in the upper-right corner. 3. Navigate to the SSL Certificate section. 4. Click "Relace Certificate". 5. Select "Import Key and Certificate". 6. Select the Private Key Type and upload the private key, public certificate, and the CA certificate or chain. 7. Select "Import Files".

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DODDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DODDoW-approved CA, trust of this CA has not been established. The DODDoW will only accept PKI certificates obtained from a DODDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes using SSL/TLS certificates. The application server must only allow using DODDoW PKI-established certificate authorities for verification. Satisfies: SRG-APP-000427-AS-000264, SRG-APP-000514-AS-000137

V-279445 in V1R2

Discussion

When data is written to digital media such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. Fewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact if accessed by unauthorized personnel. In these situations, it is assumed the physical access controls where the media resides provide adequate protection. As part of a defense-in-depth strategy, data owners and DODDoW consider routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner/steward. The selection of the cryptographic mechanisms used is based upon maintaining the confidentiality and integrity of the information. The strength of mechanisms is commensurate with the classification and sensitivity of the information. The application server must directly provide, or provide access to, cryptographic libraries and functionality that allow applications to encrypt data when it is stored.

V-279446 in V1R2

Severity

mediumhigh

V-279448 in V1R2