STIGQter: STIG Summary: AvePoint Compliance Guardian Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Mar 2023:

Compliance Guardian must use multifactor authentication for network access to privileged accounts.

DISA Rule

SV-256844r890142_rule

Vulnerability Number

V-256844

Group Title

SRG-APP-000149

Rule Version

APCG-00-000025

Severity

CAT I

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

Configure Compliance Guardian to use Smart Card Authentication, which is required to enable Client Certificate Authentication and Windows Authentication in both IIS Manager and Compliance Guardian.

On the Compliance Guardian Manager server, open IIS Manager.
- Open the "Authentication" settings under IIS.
- Enable the "Active Directory Client Certificate Authentication" and "Windows Authentication" options.
- Expand "Sites" and click "Compliance Guardian site". The default site name is "ComplianceGuardian4Site".
- Open the SSL Settings of ComplianceGuardian4Site under IIS.
- Make sure the "Require SSL" checkbox is selected.
- Open the Authentication Settings of ComplianceGuardian4Site under IIS.
- Make sure the status of "Windows Authentication" is "Enabled".
- Expand ComplianceGuardian4Site, Trust (virtual path).
- Open the SSL Settings of Trust (virtual path) under IIS.
- Make sure the "Require SSL" checkbox is selected and the option of "Client Certificates" is selected as required.
- Restart ComplianceGuardian4 Application Pool and Website.

On Compliance Guardian side:
- Log on to Compliance Guardian with admin account.
- On the Control Panel page in the General Security section, click "Authentication Manager".
- Click the "Enable link" button on the "Client Certificate Authentication" row to enable client certificate authentication.
- Click the "Enable link" button on the "Windows Authentication" row to enable Windows Authentication.
- Back in the Control Panel page in the Account section, click "Users".
- Navigate to "Add User" page.
- Select "Client Certificate User" from the drop-down list in the "User Type" field.
- Specify the user in the "Windows User/Group Name" field.
- Add this user to one or more Compliance Guardian groups.
- Save the settings.

Check Contents

Compliance Guardian supports Client Certificate Authentication for multifactor authentication, which requires that both Windows Authentication and Client Certificate Authentication are enabled in Compliance Guardian.

Check the Compliance Guardian Client Certificate Authentication configuration.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page in the General Security section, click "Authentication Manager".
- Verify that the Client Certificate Authentication option is enabled.

If Client Certificate Authentication is not enabled, this is a finding.

Check the Compliance Guardian Windows Authentication configuration.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page in the General Security section, click "Authentication Manager".
- Verify that the "Windows Authentication" option is enabled.

If "Windows Authentication" is not enabled, this is a finding.

Vulnerability Number

V-256844

Documentable

False

Rule Version

APCG-00-000025

Severity Override Guidance

Compliance Guardian supports Client Certificate Authentication for multifactor authentication, which requires that both Windows Authentication and Client Certificate Authentication are enabled in Compliance Guardian.

Check the Compliance Guardian Client Certificate Authentication configuration.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page in the General Security section, click "Authentication Manager".
- Verify that the Client Certificate Authentication option is enabled.

If Client Certificate Authentication is not enabled, this is a finding.

Check the Compliance Guardian Windows Authentication configuration.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page in the General Security section, click "Authentication Manager".
- Verify that the "Windows Authentication" option is enabled.

If "Windows Authentication" is not enabled, this is a finding.

Check Content Reference

M

Target Key

5531