STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-251235r961095_rule

Vulnerability Number

V-251235

Group Title

SRG-APP-000211-DB-000122

Rule Version

RD6X-00-010100

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

Configure DBMS to separate database administration and general user functionality.

Check Contents

Redis Enterprise provides separate user functionality by default. An administrative control plane helps facilitate configuration and a database layer helps facilitate application integrations with the database. This functionality is provided by default; however, the same user may be used for both the database layer and the administrative control plane.

First, obtain the list of authorized admin users and general users.
To check user functionality, perform the following steps:
1. Log in to the administrative control plane.
2. Navigate to the access controls tab.
3. Navigate to the roles tab.
4. Review all roles and verify that any role that provides access to the data path is configured with the cluster management role of "None".

If a role provides access to both data and management paths, this is a finding.

Vulnerability Number

V-251235

Documentable

False

Rule Version

RD6X-00-010100

Severity Override Guidance

Redis Enterprise provides separate user functionality by default. An administrative control plane helps facilitate configuration and a database layer helps facilitate application integrations with the database. This functionality is provided by default; however, the same user may be used for both the database layer and the administrative control plane.

First, obtain the list of authorized admin users and general users.
To check user functionality, perform the following steps:
1. Log in to the administrative control plane.
2. Navigate to the access controls tab.
3. Navigate to the roles tab.
4. Review all roles and verify that any role that provides access to the data path is configured with the cluster management role of "None".

If a role provides access to both data and management paths, this is a finding.

Check Content Reference

M

Target Key

5443