STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024: STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:SV-251031r1029566_rule
V-251031
SRG-NET-000339-ALG-000090
MOIS-AL-000900
CAT II
10
If user authentication intermediary services are provided, configure the Sentry to implement multifactor authentication for remote access to nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.
1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon for the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation.
4. Depending on the option selected, follow the instructions in one of the following section to complete the configuration:
- Group Certificate
Refer to "Configuring authentication using a group certificate" for next steps.
- Identity Certificate
Refer to "Configuring authentication using an identity certificate and Pass Through" for next steps.
OR
Refer to "Configuring authentication using an identity certificate and Kerberos constrained delegation" for next steps.
For more information, in the "Sentry 9.8.0 Guide for Core", refer to the main section "Device and Server Authentication", which contains the subsection "Configuring device and server authentication".
If the Sentry does not provide user authentication intermediary services, this is not applicable.
Verify the Sentry implements multifactor authentication for remote access to nonprivileged accounts.
Verify the MobileIron Core has a device-level password policy enforcing password or biometric and is applied to managed devices. This should be done by default.
Verify the Sentry is configured for certificate-based authentication.
If the Sentry is set up as an intermediary service for backend resources:
1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon for the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation.
4. Depending on the option selected, follow the instructions in one of the following sections to verify the configuration is correct:
- Group Certificate
- Identity Certificate
- Identity Certificate with Kerberos constrained delegation
If the "Device Authentication Configuration" is not set up correctly, this is a finding.
V-251031
False
MOIS-AL-000900
If the Sentry does not provide user authentication intermediary services, this is not applicable.
Verify the Sentry implements multifactor authentication for remote access to nonprivileged accounts.
Verify the MobileIron Core has a device-level password policy enforcing password or biometric and is applied to managed devices. This should be done by default.
Verify the Sentry is configured for certificate-based authentication.
If the Sentry is set up as an intermediary service for backend resources:
1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon for the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation.
4. Depending on the option selected, follow the instructions in one of the following sections to verify the configuration is correct:
- Group Certificate
- Identity Certificate
- Identity Certificate with Kerberos constrained delegation
If the "Device Authentication Configuration" is not set up correctly, this is a finding.
M
5439