Password changes to the MSCA ACID will be documented in the change log.

Associated with IA controls: DCCS-1, DCCS-2

SV-236r2_rule Password changes to the MSCA ACID will be documented in the change log.

Vulnerability discussion

The system MSCA will be a limited use ACID, which is not available to any individual for day to day processing. Limit its use only to performing required security administration functions. The Primary SCA will assume the use of, and the responsibility for, the MSCA by changing the MSCA password. The password change command will include a comment indicating the reason.

Check content

Refer to the following report produced by the TSS Data Collection: - TSSCHNGS.RPT Note: If running Quest NC-Pass, validate in ZNCP0020 that the MSCA ACID has the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class. If the MSCA password changes are documented in the change log, this is not a finding.

Fix text

The IAO will ensure that the MSCA password changes are documented with comments in the the TSS Recovery file. The TSS Recovery file will be of sufficient size to ensure that the change is documented.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.