The KVM switch must be configured to force the change of the configuration password every 90 days or there is no policy and procedure in place to change the configuration password every 90 days.

From Keyboard Video and Mouse Switch STIG

Part of KVM switch configuration password change

Associated with IA controls: DCBP-1

SV-6848r2_rule The KVM switch must be configured to force the change of the configuration password every 90 days or there is no policy and procedure in place to change the configuration password every 90 days.

Vulnerability discussion

The longer the time between password changes the greater the chance the password will become compromised. A compromised password can allow a malicious user to change the configuration of the KVM switch creating a denial of service or a compromise of sensitive data.The ISSO will ensure the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days.

Check content

The reviewer will, with the assistance of the ISSO or SA, verify the KVM switch is configured to force the change of the configuration password every 90 days or there is a policy and procedure in place to change the configuration password every 90 days. If the switch is not configured or there is no policy or procedure in place to force a configuration password change every 90 days, this is a finding.

Fix text

Configure the KVM switch to force the change of the configuration password every 90 days or if the KVM switch does not support this functionality, create a policy and procedure to change the configuration password every 90 days.

Pro Tips

Powered by sagemincer