STIGQter: STIG Summary: Riverbed NetIM NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The Riverbed NetIM must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.

DISA Rule

SV-275481r1148299_rule

Vulnerability Number

V-275481

Group Title

SRG-APP-000065-NDM-000214

Rule Version

RIIM-DM-000041

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Configure the Password Rules for Maximum failed login attempts allowed.

1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer.
2. On the User Management screen, select "Password Rules".
3. Check the box for "Maximum failed login attempts allowed".
4. Enter "3" in the option box.
5. Check the box for "Time interval for max failed login attempts in minutes".
6. Enter "15" in the option box and click "Submit".

Note: Local users must not be created; however, setting these requirements are a good best practice.

Check Contents

Verify Password Rules are configured for "Maximum failed login attempts allowed".

1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer.
2. On the User Management screen, select "Password Rules".
3. Verify "Maximum failed login attempts allowed" is checked and set to "3".
4. Verify "Time interval for max failed login attempts in minutes" is set to "15".

If both "Maximum failed login attempts allowed" is not set to "3" and the "Time interval for max failed login attempts in minutes" is set to "15", this is a finding.

Vulnerability Number

V-275481

Documentable

False

Rule Version

RIIM-DM-000041

Severity Override Guidance

Verify Password Rules are configured for "Maximum failed login attempts allowed".

1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer.
2. On the User Management screen, select "Password Rules".
3. Verify "Maximum failed login attempts allowed" is checked and set to "3".
4. Verify "Time interval for max failed login attempts in minutes" is set to "15".

If both "Maximum failed login attempts allowed" is not set to "3" and the "Time interval for max failed login attempts in minutes" is set to "15", this is a finding.

Check Content Reference

M

Target Key

5704