STIGQter: STIG Summary: IBM Hardware Management Console (HMC) Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

A private web server must subscribe to certificates, issued from any DOD-authorized Certificate Authority (CA), as an access control mechanism for web users.

DISA Rule

SV-256885r998338_rule

Vulnerability Number

V-256885

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

HMC0170

Severity

CAT II

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

The SA must order a DOD PKI to replace the IBM Certificate and then use the Hardware Management Console Certificate Management Task to install it.

Note: This only applies to networked HMCs.

Check Contents

The System Reviewer will have the system administrator (SA) use the Hardware Management Console Certificate Management Task to validate that the private key and certificate shipped with any network-connected HMC from IBM was replaced with an approved DOD-authorized Certificate.

Note: This check applies only to network-connected HMCs.

Note: DOD certificates should display the following Information: 'OU=PKI.OU=DoD.O=U.S. Government.C=US'

If private web server does not subscribe to certificates issued from any DOD-authorized Certificate Authority (CA) as an access control mechanism for web users, this is a finding.

Vulnerability Number

V-256885

Documentable

False

Rule Version

HMC0170

Severity Override Guidance

The System Reviewer will have the system administrator (SA) use the Hardware Management Console Certificate Management Task to validate that the private key and certificate shipped with any network-connected HMC from IBM was replaced with an approved DOD-authorized Certificate.

Note: This check applies only to network-connected HMCs.

Note: DOD certificates should display the following Information: 'OU=PKI.OU=DoD.O=U.S. Government.C=US'

If private web server does not subscribe to certificates issued from any DOD-authorized Certificate Authority (CA) as an access control mechanism for web users, this is a finding.

Check Content Reference

M

Target Key

5533