Userids found inactive for more than 35 days are not suspended.

Associated with: CCI-000017

SV-8037r2_rule Userids found inactive for more than 35 days are not suspended.

Vulnerability discussion

Userid maintenance is critical in a C2 level of trust environment. Userids left on the system for extended periods of time could be reassigned to a different user while retaining the access authorizations of the previous user. The improper management of userids could result in the compromise of the operating system environment, ACP, and customer data.

Check content

a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(UNUSED35) b) If every user shows a LAST-USED=yy.ddd within the past 35 days, there is NO FINDING. c) If the above is untrue, this is a FINDING. NOTE: VALID FOR INTERACTIVE USERIDS, NOT VALID FOR STARTED TASK USERIDS AND BATCH USERIDS.

Fix text

The IAO must develop a procedure to check all userids for inactivity more than 35 days. If found, the IAO must suspend an account, but not delete it until it is verified by the local IAO that the user no longer requires access. If verification is not received within 60 days, the account may be deleted.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.