The Mainframe Product must require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan.

From Mainframe Product Security Requirements Guide

Part of SRG-APP-000390-MFP-000205

Associated with: CCI-002039

SV-82819r1_rule The Mainframe Product must require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan.

Vulnerability discussion

Without reauthenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of devices, including (but not limited to), the following other situations.(i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change;(iv) After a fixed period of time; or (v) Periodically.For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.Gateways and SOA applications are examples of where this requirement would apply.

Check content

If the Mainframe Product has no function or capability for device logon, this is not applicable. If the Mainframe Product employs an external security manager for all account management functions, this is not applicable. Examine user account management configurations. If the Mainframe Product is configured to require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan, this is not a finding.

Fix text

Configure the Mainframe Product to require devices to reauthenticate when circumstances or situations require reauthentication as defined in site security plan.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer