STIGQter: STIG Summary: IBM Hardware Management Console (HMC) Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

DCAF Console access must require a password to be entered by each user.

DISA Rule

SV-256861r958482_rule

Vulnerability Number

V-256861

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

HLESC085

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Have the System Administrator review access authorization to DCAF Consoles. Ensure that all personnel are required to enter a password.

Remote access to the LAN may be provided through DCAF via a LAN or modem connection.
DCAF passwords should be implemented to prevent unauthorized access.

Check Contents

If the ESCON Director Application is present, have the System Administrator attempt to sign on to the DCAF Console and validate that a password is required, otherwise, this check is not applicable.

If sign-on access to the DCAF Console does not require a password this is a finding.

Vulnerability Number

V-256861

Documentable

False

Rule Version

HLESC085

Severity Override Guidance

If the ESCON Director Application is present, have the System Administrator attempt to sign on to the DCAF Console and validate that a password is required, otherwise, this check is not applicable.

If sign-on access to the DCAF Console does not require a password this is a finding.

Check Content Reference

M

Target Key

5533