The network device must require users to re-authenticate when privilege escalation or role changes occur.

From Network Device Management Security Requirements Guide

Part of SRG-APP-000389-NDM-000306

Associated with: CCI-002038

SV-69493r1_rule The network device must require users to re-authenticate when privilege escalation or role changes occur.

Vulnerability discussion

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.When devices provide the capability to change security roles, it is critical the user re-authenticate.In addition to the re-authentication requirements associated with session locks, organizations may require re-authentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances.(i) When authenticators change;(ii) When roles change;(iii) When security categories of information systems change;(iv) When the execution of privileged functions occurs;(v) After a fixed period of time; or(vi) Periodically.Within the DoD, the minimum circumstances requiring re-authentication are privilege escalation and role changes.

Check content

Determine if the network device requires users to re-authenticate when privilege escalation or role changes occur. This requirement may be verified by demonstration, configuration review, or validated test results. This requirement may be met through use of a properly configured authentication server if the device is configured to use the authentication server. If users are not required to re-authenticate when privilege escalation or role changes occur, this is a finding.

Fix text

Configure the network device or its associated authentication server to require users to re-authenticate when privilege escalation or role changes occur.

Pro Tips

Powered by sagemincer