STIGQter: STIG Summary: Network Device Management Security Requirements Guide Version: 4 Release: 1 Benchmark Date: 23 Apr 2021:

If the network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.

DISA Rule

SV-202092r399682_rule

Vulnerability Number

V-202092

Group Title

SRG-APP-000329

Rule Version

SRG-APP-000329-NDM-000287

Severity

CAT II

CCI(s)

• CCI-002169 - The information system enforces a role-based access control policy over defined subjects and objects.
• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the network device or its associated authentication server to enforce role-based access control policy over defined subjects and objects.

Check Contents

Determine if the network device enforces role-based access control policy over defined subjects and objects. This requirement may be verified by demonstration, configuration review, or validated test results. This requirement may be met through use of a properly configured authentication server if the device is configured to use the authentication server. If role-based access control policy is not enforced over defined subjects and objects, this is a finding.

Vulnerability Number

V-202092

Documentable

False

Rule Version

SRG-APP-000329-NDM-000287

Severity Override Guidance

Determine if the network device enforces role-based access control policy over defined subjects and objects. This requirement may be verified by demonstration, configuration review, or validated test results. This requirement may be met through use of a properly configured authentication server if the device is configured to use the authentication server. If role-based access control policy is not enforced over defined subjects and objects, this is a finding.

Check Content Reference

M

Target Key

2890

Comments