None Computing title Aviat Networks WTM NDM Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-286471 Rule_ID SV-286471r1274120_rule Severity medium Rule_Title WTM must configure management ACLs to enforce approved authorizations for controlling the flow of management information. Vuln_Discuss A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If management information flow is not enforced based on approved authorizations, the network device may become compromised. Information flow control regulates where management information is allowed to travel within a network device. The flow of all management information must be monitored and controlled so it does not introduce any unacceptable risk to the network device or data. Application-specific examples of enforcement occur in systems that employ rule sets or establish configuration settings that restrict information system services or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of management information within the system in accordance with applicable policy. This requirement also applies to Zero Trust initiatives. Satisfies: SRG-APP-000038-NDM-000213, SRG-APP-000435-NDM-000315, SRG-APP-000516-NDM-000335 Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Admin >> Management ACL. If management ACLs to enforce approved authorizations for controlling the flow of management information are not configured, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> Management ACL. 3. Click "Add". 4. Enter a name for the ACL. 5. Under "Type", select "Both". 6. Click "New TCP". 7. Under Match Port, enter "22" for the SSH CLI, and under Action select "accept". 8. Click "New TCP". 9. Under Match Port, enter "443" for the HTTP Web UI, and under Action, select "accept". 10. Click "New UDP". 11. Under Match Port, enter "161" for SNMPv3, and under Action, select "accept". 12. Click "New TCP". 13. Under Match Port, enter "51966" for the internal systems port, and under Action, select "drop". 14. Click "New TCP". 15. Under Match Port, enter "51967" for the internal systems port, and under Action, select "drop". 16. Click "New TCP". 17. Under Match Port, enter "830" for NETCONF, and under Action, select "drop". 18. Click "Enabled". 19. Click "Commit". Not_Reviewed Vuln_Num V-286473 Rule_ID SV-286473r1274022_rule Severity medium Rule_Title WTM must be configured to authenticate SNMPv3 messages using a FIPS 140-3-validated Keyed-Hash Message Authentication Code (HMAC). Vuln_Discuss Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network, internet). A remote connection is any connection with a device communicating through an external network (e.g., the internet). Because of the challenges of applying this requirement on a large scale, organizations are encouraged to only apply the requirement to those limited number (and type) of devices that truly need to support this capability. Check_Content 1. Log in to the SSH CLI. 2. Enter "show running-config | include snmp". 3. Verify it shows as v3-only. 4. Verify the Auth Protocol displays as "sha256". If SNMPv3 is not set to V3 with the authentication protocol of "sha256", this is a finding. Fix_Text 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "snmp v3-only". 4. Enter "user <user> role security" - replace <user> with the SNMPv3 username. 5. Enter the password for the user - it will not be able to be used to log in unless that role is allowed. 6. Enter "user <user> snmpv3 enabled min-sec-level authPriv auth-protocol hmac-sha-256 priv-protocol aes" - replace <user> with the SNMPv3 username. 7. Enter "user <user> snmpv3 auth-password <pass>" - replace <user> with the SNMPv3 username and <pass> with the authentication password. 8. Enter "user <user> snmpv3 priv-password <pass>" - replace <user> with the SNMPv3 username and <pass> with the privacy password. 9. Enter "snmp community <user>" - replace <user> with the SNMPv3 username. 10. Enter "Commit". Not_Reviewed Vuln_Num V-286474 Rule_ID SV-286474r1274121_rule Severity medium Rule_Title WTM must enforce password complexity by requiring that at least one uppercase character be used. Vuln_Discuss Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available and for the account of last resort and root account. Check_Content 1. From the WebUI, navigate to Admin >> User Management >> Login Control. 2. Under the "Passwords" section, verify "Uppercase" is set to "1". If "Uppercase" is not set to "1", this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set "Uppercase" to "1". 5. Click "Commit". Not_Reviewed Vuln_Num V-286475 Rule_ID SV-286475r1274122_rule Severity medium Rule_Title WTM must enforce password complexity by requiring that at least one lowercase character be used. Vuln_Discuss Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available and for the account of last resort and root account. Check_Content 1. From the WebUI, navigate to Admin >> User Management >> Login Control. 2. Under the "Passwords" section, verify "Lowercase" is set to "1". If "Lowercase" is not set to "1", this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set "Lowercase" to "1". 5. Click "Commit". Not_Reviewed Vuln_Num V-286476 Rule_ID SV-286476r1274123_rule Severity medium Rule_Title WTM must enforce password complexity by requiring that at least one numeric character be used. Vuln_Discuss Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available and for the account of last resort and root account. Check_Content 1. From the WebUI, navigate to Admin >> User Management >> Login Control. 2. Under the "Passwords" section, verify "Numeric" is set to "1". If "Numeric" is not set to "1", this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set "Numeric" to "1". 5. Click "Commit". Not_Reviewed Vuln_Num V-286477 Rule_ID SV-286477r1274124_rule Severity medium Rule_Title WTM must enforce password complexity by requiring at least one special character be used. Vuln_Discuss Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available and for the account of last resort and root account. Check_Content 1. From the WebUI, navigate to Admin >> User Management >> Login Control. 2. Under the "Passwords" section, verify "Special" is set to "1". If "Special" is not set to "1", this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set "Special" to "1". 5. Click "Commit". Not_Reviewed Vuln_Num V-286478 Rule_ID SV-286478r1274151_rule Severity high Rule_Title WTM must have a version of Aviat OS installed that is version 6.x or later and currently supported by the vendor. Vuln_Discuss Unsupported software and systems must not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilities. Software and systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation. When maintenance updates and patches are no longer available, software is no longer considered supported and should be upgraded or decommissioned. Satisfies: SRG-APP-001035-NDM-000340, SRG-APP-000516-NDM-000351, SRG-APP-000457-NDM-000352 Check_Content 1. Log in to the SSH CLI. 2. Enter "show version". 3. Capture the version number and build (e.g., 6.2.1[12.57800]). 1. Log in to the AviatCloud Support Portal at www.aviatcloud.com. 2. Once logged in, click the "software packages" tile. 3. Filter by product (e.g., WTM 4000). If the software version currently installed is not version 6.x or later and currently supported by the vendor, this is a finding. Fix_Text 1. Log in to the AviatCloud Support Portal at www.aviatcloud.com. 2. Once logged in, click the "software packages" tile. 3. Filter by product (e.g., WTM 4000). 4. Download the latest supported version that is version 6.x or later (e.g., 6.2.1[12.57800]). 5. Once downloaded, log in to the Web UI. 6. Navigate to Admin >> Software Management. 7. Under software upgrade, click "local file". 8. Under choose file, select the install file downloaded from AviatCloud. 9. Under Activation, select "Immediately". 10. Under "Configuration", select "Keep". 11. Click "Start" to begin the upgrade. During the upgrade process the image will be checked for its checksum before installing. Note: Version 6.x supports DoW-mandated FIPS and HMAC algorithms. Not_Reviewed Vuln_Num V-286479 Rule_ID SV-286479r1273718_rule Severity high Rule_Title WTM must enable FIPS mode so only FIPS 140-3-approved algorithms for authentication to a cryptographic module are selectable for use. Vuln_Discuss Unapproved mechanisms that are used for authentication to the cryptographic module are not validated and therefore, cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised. Network devices utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoW requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms. Satisfies: SRG-APP-000179-NDM-000265, SRG-APP-000411-NDM-000330, SRG-APP-000224-NDM-000270, SRG-APP-000172-NDM-000259, SRG-APP-000142-NDM-000245, SRG-APP-000412-NDM-000331 Check_Content 1. Log in to the SSH CLI. 2. Enter "show crypto fips-mode-status". If "show crypto fips-mode-status" is not set to "true", this is a finding. Fix_Text 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "crypto tls cipher ECDHE-ECDSA-CHACHA20-POLY1305 dis". 4. Enter "crypto tls cipher TLS_CHACHA20_POLY1305_SHA256 dis". 5. Enter "crypto tls cipher ECDHE-RSA-CHACHA20-POLY1305 dis". 6. Enter "crypto ssh kex curve25519-sha256 dis". 7. Enter "crypto fips-mode enabled". 8. Enter "Commit" and accept the warnings. 9. Press "Enter" to reboot. Not_Reviewed Vuln_Num V-286480 Rule_ID SV-286480r1274129_rule Severity high Rule_Title WTM must be configured to implement multifactor authentication (MFA) for local, network, and/or remote access to privileged accounts using DoW PKI. Vuln_Discuss The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during MFA is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process. Satisfies: SRG-APP-000820-NDM-000170, SRG-APP-000153-NDM-000249, SRG-APP-000080-NDM-000220, SRG-APP-000231-NDM-000271, SRG-APP-000825-NDM-000180, SRG-APP-000033-NDM-000212, SRG-APP-000121-NDM-000238, SRG-APP-000122-NDM-000239, SRG-APP-000149-NDM-000247, SRG-APP-000516-NDM-000336, SRG-APP-000119-NDM-000236, SRG-APP-000156-NDM-000250 Check_Content 1. Log in to the WTM Web UI. 2. Verify the "SAML Login" is present. 3. Click "SAML Login", to be redirected to the ADFS server logon page. 4. Select the CAC/AltToken certificate and log in. 5. Navigate to Admin >> User Management >> Multifactor Auth. 6. Verify that Mode is set to "both" and the ADFS server is configured to meet DoW requirements. If the Mode shows disabled or an ADFS server is not configured, this is a finding. Fix_Text WTM Web UI: 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Multifactor Auth. 3. Under mode, select both. 4. Under "Provider ID", type the URL of the Active Directory Federated Services (ADFS) server (e.g., http://adfs.dow.mil/adfs/services/trust). 5. Under "Sign On URL", enter the URL of the ADFS sign-on URL (e.g., https://adfs.dow.mil/adfs/ls/). 6. Under "Sign Out URL", enter the URL of the ADFS sign-out URL. In most cases, the sign-on and sign-out URLs are the same (e.g., https://adfs.dow.mil/adfs/ls/). 7. Enter a "Max Clock Skew (s)" of 10 or greater. 8. Copy and paste the ADFS signing certificate in the block for "Provider Certificate". This is the certificate the ADFS server uses to sign the SAML tokens. This is not an encryption certificate. 9. Under "Relying Party ID", enter the URL of the WTM web UI (e.g., https://wtm.dow.mil). 10. Click "Commit". 11. Under the block for "ADFS Setup", copy all the information to be used on the ADFS server configuration in the next steps. 12. Click "Logout". ADFS Server: 1. Log in to the ADFS server. 2. Under "Relying Party Trusts", create new. 3. Select "Claims Aware". 4. Select "Enter data manually". 5. Add a name, preferably add the FQDN with https (e.g., https://wtm.dow.mil). 6. Click "Enable support for SAML 2.0" and add the service URL (e.g., add the same URL but add /saml/consume at the end, such as https://wtm.dow.mil/saml/consume). 7. Add the relying party ID, the URL https://wtm.dow.mil. 8. Permit everyone. 9. Click "Next" and then "Next" again to configure the claims. a. Add the "LDAP Attribute As Claim" for User-Principal-Name (UPN) inside the attribute store AD as Name ID. b. Add a new "Send Group Membership as a Claim". c. For operator, add the Operator group. The outgoing claim type is "Role", and outgoing claim value is "Oper". d. For admin, add the Admins group. The outgoing claim type is "Role", and outgoing claim value is "admin". e. For security, add the Security group. The outgoing claim type is "Role", and outgoing claim value is "security". Log back in to the WTM Web UI. There should now be a "SAML Login" button. 1. Click "SAML Login", to be redirected to the ADFS server logon page. 2. Select the CAC/AltToken certificate. This should result in a successful login. 3. Check the logs for any login issues or exceptions. Not_Reviewed Vuln_Num V-286481 Rule_ID SV-286481r1274154_rule Severity medium Rule_Title WTM must retain the Standard Mandatory DoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log in for further access. Vuln_Discuss The banner must be acknowledged by the administrator prior to the device allowing the administrator access to the network device. This provides assurance that the administrator has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the administrator, DoW will not be in compliance with system use notifications required by law. To establish acceptance of the network administration policy, a click-through banner at management session logon is required. The device must prevent further activity until the administrator executes a positive action to manifest agreement. In the case of CLI access using a terminal client, entering the username and password when the banner is presented is considered an explicit action of acknowledgement. Entering the username, viewing the banner, then entering the password is also acceptable. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. View "GUI Banner" and "Pre Login". 4. Under "CLI Banner" and "Pre Login", if the GUI banner, the CLI banner, and each "Pre Login" is not configured with the proper DoW login text as shown below, this is a finding. DoW Notice and Consent Text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. Under "GUI Banner" and "Pre Login", enter the following text. Include the "<br><br>" line to ensure the spacing is correct. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: <br><br> -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 4. Under "CLI Banner" and "Pre Login", enter the following text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 5. Click "Commit". Not_Reviewed Vuln_Num V-286482 Rule_ID SV-286482r1274157_rule Severity high Rule_Title WTM must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required. Vuln_Discuss The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can be used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, are important in showing whether someone is an internal employee or an outside threat. A network boundary device is a piece of networking hardware that sits at the edge of a network, controlling the flow of data traffic between the internal network and external networks like the internet. It acts as a gatekeeper, enforcing security policies and protecting the internal network from unauthorized access and malicious attacks. Having a second central log server delivers a defense in depth approach for critical boundary devices. Satisfies: SRG-APP-000516-NDM-000350, SRG-APP-000515-NDM-000325 Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. View "GUI Banner" and "Pre Login". 4. Under "CLI Banner" and "Pre Login", if the GUI banner, the CLI banner, and each "Pre Login" is not configured with the proper DoW login text as shown below, this is a finding. DoW Notice and Consent Text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. Under "GUI Banner" and "Pre Login", type the following text. Include the "<br><br>" line to ensure the spacing is correct. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: <br><br> -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 4. Under "CLI Banner" and "Pre Login", enter the following text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 5. Click "Commit". Not_Reviewed Vuln_Num V-286483 Rule_ID SV-286483r1274137_rule Severity high Rule_Title WTM must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements. Vuln_Discuss Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level, or deallocating networking assignments at the application level if multiple application sessions are using a single, operating system-level network connection. This does not mean that the device terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Remote Logging. If there is no remote syslog server configured to use TLS and secure mode, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Remote Logging. 3. Ensure the DoW CA certs that were imported previously include those that have signed the syslog server certificate. 4. Click "Add". 5. Under address, enter the fully qualified domain hostname or IPv4 address of the syslog server. 6. For protocol, select "TLS.7". For mode, select "Secure". 7. Repeat these steps for any additional servers. 8. Click "Commit". Not_Reviewed Vuln_Num V-286485 Rule_ID SV-286485r1274139_rule Severity high Rule_Title WTM must be configured to store passwords using an approved salted key derivation function, preferably using a keyed hash for password-based authentication. Vuln_Discuss Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Network devices must enforce cryptographic representations of passwords when storing passwords in databases, configuration files, and log files. Passwords must be protected at all times; using a strong one-way hashing encryption algorithm with a salt is the standard method for providing a means to validate a password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one way hash is the most feasible means of securing the password and providing an acceptable measure of password security. If passwords are stored in clear text, they can be plainly read and easily compromised. In many instances, verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the stored hash. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Verify "Login Control" is enabled and "GUI Idle Timeout" is set to at least 300 seconds. 4. Log in to the SSH CLI. 5. Enter "configure terminal". 6. Enter "show running-config | include session". If "session idle-timeout" is absent or does not say at least 300 for both the CLI and GUI, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set the "GUI Idle Timeout" to "300 seconds". 5. Click "Commit". 6. Log in to the SSH CLI. 7. Enter "configure terminal". 8. Enter "session idle-timeout 300". 9. Enter "Commit" and then press "Enter". Not_Reviewed Vuln_Num V-286486 Rule_ID SV-286486r1274033_rule Severity medium Rule_Title WTM must enforce a minimum 15-character password length. Vuln_Discuss Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Verify "Login Control" is enabled. If "Login Control" is not enabled and "Minimum Password Length" is not set to 15, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set the "Minimum Password Length" to "15". 5. Click "Commit". Not_Reviewed Vuln_Num V-286487 Rule_ID SV-286487r1273742_rule Severity medium Rule_Title WTM must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths. Vuln_Discuss Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Communications paths can be logically separated using encryption. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Switching and Routing >> VLAN Management >> Membership. 3. Verify that both GigabitEthernet1/1 and 1/2 are on mode access. 4. Verify GigabitEthernet1/1 and 1/2 are using different VLAN IDs. If GigabitEthernet1/1 and 1/2 are using the same VLAN IDs, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Switching and Routing >> VLAN Management >> Membership. 3. If GigabitEthernet1/1 is the out of band management interface, then select mode access. 4. On GigabitEthernet1/1 under settings, select the VLAN for the management network. 5. On GigabitEthernet1/2, if it is a trunk link (meaning it is carrying 802.1q tagged VLAN traffic), select trunk for the mode. 6. Enter all the VLANs in the allowed VLANs field. Ensure that the management VLAN is not in this list. 7. On GigabitEthernet1/2, if it is an access link (meaning it is carrying traffic that is not tagging the 802.1q field), select access for the mode. 8. Select the VLAN ID being used for data plane traffic. The management VLAN must not be selected. 9. Click "Commit". Not_Reviewed Vuln_Num V-286488 Rule_ID SV-286488r1274141_rule Severity medium Rule_Title WTM must obtain its public key certificates from an appropriate certificate policy through an approved service provider. Vuln_Discuss For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this certification authority will suffice. Satisfies: SRG-APP-000516-NDM-000344, SRG-APP-000910-NDM-000300 Check_Content 1. Log in to the SSH CLI. 2. Enter "show crypto installed-tls-certificate". 3. Verify a DoW certificate is configured. If "crypto installed-tls-certificate contents" is absent or does not contain a valid DoW CA Issuer, this is a finding. Fix_Text 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "tls-import-ca-certificate certificate-name <CA NAME> certificate-data" and press "Enter". 4. Paste the certificate data from the DoW CA certificate and press enter. 5. Repeat these steps for the root and issuing CA certificate for the WTM. 6. Enter "tls-import-certificate private-key" and press enter. 7. Paste in the contents of the private TLS key and press enter. 8. If it is not encrypted, press enter without entering a password. 9. Once promoted for the certificate, paste it and press enter. 10. Enter commit, accept the warnings, and press enter. The system will need to be rebooted. Not_Reviewed Vuln_Num V-286489 Rule_ID SV-286489r1273748_rule Severity medium Rule_Title WTM must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). Vuln_Discuss If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by the application include date and time. Time is commonly expressed in UTC, a modern continuation of GMT, or local time with an offset from UTC. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Date and Time. If the device time zone is not set to UTC or GMT, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Date and Time. 3. Under device time zone, select "UTC". 4. Click "Commit". Not_Reviewed Vuln_Num V-286490 Rule_ID SV-286490r1274143_rule Severity medium Rule_Title WTM must require that when a password is changed, the characters are changed in at least eight of the positions within the password. Vuln_Discuss If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. In other words, characters may be the same within the two passwords; however, the positions of the like characters must be different. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available and for the account of last resort and root account. Check_Content 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "show running-config | include strong". If "strong-security" is not enabled, this is a finding. Fix_Text 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "strong-security enabled". 4. Enter commit and then press "Enter". Not_Reviewed Vuln_Num V-286491 Rule_ID SV-286491r1274035_rule Severity medium Rule_Title WTM must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based. Vuln_Discuss If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source. Satisfies: SRG-APP-000395-NDM-000347, SRG-APP-000925-NDM-000330 Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Date and Time. 3. Verify the clock source is configured as NTP. 4. Verify there are at least two NTP servers configured. 5. Verify SHA1 authentication keys are used. If compliant NTP sources using authentication that is cryptographically based are not configured, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Date and Time. 3. Under clock source, select "NTP". 4. Under poll interval enter "300". 5. Under "Configure Symmetric Key," click "Add". 6. Enter the ID number of the key from the NTP server under "key ID". 7. Under "algorithm" select "sha1". 8. Under "type", select "ASCII". 9. Under "key", enter the plain text or hexadecimal key. 10. Under "Configure NTP Server," enter a name. 11. Then enter the IPv4 address, or hostname, of the NTP server. 12. Select "Server" for Assoc-Type. 13. Select the previous configured key ID for symmetric key. 14. Click the preferred checkbox for the priority server to use; uncheck it for the secondary server. 15. Click the checkbox for "iburst". 16. Click "Commit". 17. Click "Update Now" and monitor for proper time sync. Not_Reviewed Vuln_Num V-286492 Rule_ID SV-286492r1274160_rule Severity medium Rule_Title WTM must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the device. Vuln_Discuss Display of the DoW-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. Verify "GUI Banner" and "Pre Login" are configured. 4. Verify "CLI Banner" and "Pre Login" are configured. If the GUI and CLI banners are not both configured with the proper DoW login text as shown below, this is a finding. DoW Notice and Consent Text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to System Configuration >> Site Details. 3. Under "GUI Banner" and "Pre Login", enter the following text - include the "<br><br>" line to ensure the spacing is correct. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: <br><br> -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 4. Under "CLI Banner" and "Pre Login", enter the following text: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communication and work product are private and confidential. See User Agreement for details. 5. Click "Commit". Not_Reviewed Vuln_Num V-286493 Rule_ID SV-286493r1273760_rule Severity medium Rule_Title WTM must limit the number of concurrent sessions to eight or an organizationally identified limit. Vuln_Discuss Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions must be defined based upon mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. If the "User Session Limit" is not set to "8" or to the organization's acceptable user session limit, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set the "User Session Limit" to "8", or the organization's acceptable user session limit. 5. Click "Commit". Not_Reviewed Vuln_Num V-286495 Rule_ID SV-286495r1273766_rule Severity medium Rule_Title WTM must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. Vuln_Discuss By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Check_Content 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Verify "Max Login Attempts" is set to "3". 4. Verify the "CLI Lockout Period (seconds)" is set to "900". 5. Verify the "GUI Lockout Period (seconds)" is set to "900". If the device is not configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes, this is a finding. Fix_Text 1. Log in to the WTM Web UI. 2. Navigate to Admin >> User Management >> Login Control. 3. Click "Enable". 4. Set the "Max Login Attempts" to "3". 5. Set the "CLI Lockout Period (seconds)" to "900". 6. Set the "GUI Lockout Period (seconds)" to "900". 7. Click "Commit". Not_Reviewed Vuln_Num V-286496 Rule_ID SV-286496r1273769_rule Severity medium Rule_Title WTM must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. Vuln_Discuss Authentication for administrative (privileged level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary. The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit must be added to the envelope as a record. Administrators must secure the credentials and disable the root account (if possible) when not needed for system administration functions. Check_Content 1. Log in to the SSH CLI. 2. Enter "show running-config | include user". 3. Verify only the account of last resort and the SNMPv3 user (if used) is defined locally on the WTM. If local accounts other than the account of last resort and system accounts such as SNMPv3 are on the WTM, this is a finding. Fix_Text 1. Log in to the SSH CLI. 2. Enter "configure terminal". 3. Enter "no user <username>" to remove unauthorized accounts. 4. Enter "Commit". Not_Reviewed