STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

DISA Rule

SV-258616r1043189_rule

Vulnerability Number

V-258616

Group Title

SRG-APP-000170-NDM-000329

Rule Version

IVCS-NM-000460

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Check the box for "new password must differ from the previous password position".
2. In the box, enter "8".
3. Click "Save Changes".

Check Contents

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "new password must differ from the previous password position" is checked.
2. Verify the value for the setting for "new password must differ from the previous password position" is set to "8".

If the ICS is not configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.

Vulnerability Number

V-258616

Documentable

False

Rule Version

IVCS-NM-000460

Severity Override Guidance

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "new password must differ from the previous password position" is checked.
2. Verify the value for the setting for "new password must differ from the previous password position" is set to "8".

If the ICS is not configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.

Check Content Reference

M

Target Key

5558