STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

If the HYCU virtual appliance uses role-based access control, it must enforce organization-defined role-based access control policies over defined subjects and objects.

DISA Rule

SV-268223r1137878_rule

Vulnerability Number

V-268223

Group Title

SRG-APP-000329-NDM-000287

Rule Version

HYCU-ND-000050

Severity

CAT II

CCI(s)

• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Ensure the correct RBAC controls and access are applied properly within the HYCU Web UI's Self-Service menu. Avoid granting too much access to any particular user or group.

For the HYCU VM console, administrators should only allow access to anyone else deemed to be qualified as a server administrator for the system.

To check for any unauthorized users, run the following command within the HYCU Web console:
cat /etc/passwd

Use the "userdel" command to remove any unauthorized users.

Check Contents

HYCU offers the capability to leverage RBAC controls within the Web UI's Self-Service menu. The organization would need to generate and document its own specific requirements around using RBAC in HYCU.

For the HYCU VM console, administrators should only allow access to anyone else deemed to be qualified as a server administrator for the system.

Review the groups and accounts within Web UI's Self-Service menu.

If any RBAC setting does not meet the organization's guidelines, this is a finding.

Vulnerability Number

V-268223

Documentable

False

Rule Version

HYCU-ND-000050

Severity Override Guidance

HYCU offers the capability to leverage RBAC controls within the Web UI's Self-Service menu. The organization would need to generate and document its own specific requirements around using RBAC in HYCU.

For the HYCU VM console, administrators should only allow access to anyone else deemed to be qualified as a server administrator for the system.

Review the groups and accounts within Web UI's Self-Service menu.

If any RBAC setting does not meet the organization's guidelines, this is a finding.

Check Content Reference

M

Target Key

5660