STIGQter: STIG Summary: Riverbed SteelHead CX v8 NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 25 Oct 2019:

Riverbed Optimization System (RiOS) must enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device.

DISA Rule

SV-77345r1_rule

Vulnerability Number

V-62855

Group Title

SRG-APP-000033-NDM-000212

Rule Version

RICX-DM-000017

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure RiOS to enforce assigned privilege level for each administrator.

Navigate to the device CLI
Type: rbm user <username> role <role> permissions <permissions>

Set the value of username, role, and permissions according to the privilege level of the applicable policy

Type: write memory
to save the current configuration settings to memory

-- or --

Navigate to the device Management Console
Navigate to Configure >> Security >> User Permissions

Set the values of 'Roles and Permissions' according to the privilege level in accordance with applicable policy

Click "Apply" to save the changes
Navigate to the top of the web page and click "Save" to write changes to memory

Check Contents

Verify that RiOS is configured to the assigned privilege level for each administrator.

Navigate to the device CLI
Type: show rbm users

Verify that the privilege level is correct for each administrator

-- or --

Navigate to the device Management Console
Navigate to Configure >> Security >> User Permissions

Verify that the privilege level is correct for each administrator

If the privilege level settings are not in accordance with applicable policy, this is a finding.

Vulnerability Number

V-62855

Documentable

False

Rule Version

RICX-DM-000017

Severity Override Guidance

Verify that RiOS is configured to the assigned privilege level for each administrator.

Navigate to the device CLI
Type: show rbm users

Verify that the privilege level is correct for each administrator

-- or --

Navigate to the device Management Console
Navigate to Configure >> Security >> User Permissions

Verify that the privilege level is correct for each administrator

If the privilege level settings are not in accordance with applicable policy, this is a finding.

Check Content Reference

M

Target Key

2931

Comments