← Back to General Application (GAPP) Security Requirements Guide

V-288137

CAT I (High)

Local accounts must be removed after multifactor authentication (MFA) is configured. It is permissible for an emergency ("break glass") or service account to remain if absolutely required by the application. In this case, the associated complexity requirements apply.

Rule ID

SV-288137r1252644_rule

STIG

General Application (GAPP) Security Requirements Guide

Version

V1R0.1

CCIs

CCI-000765 CCI-000766 CCI-004046 CCI-000778 CCI-001953 CCI-001954 CCI-002009 CCI-002010 CCI-004046 CCI-004047

Discussion

Without the use of MFA, the ease of access to privileged functions is greatly increased. MFA requires the use of two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). The current DoW multifactor solution is the common access card (CAC). Other DoW or authorizing official (AO)-approved solutions may be implemented. To ensure MFA is used, access to local accounts must be removed.

Check Content

Navigate to the local account configuration function within the application.

Verify no local accounts exist. Otherwise, this is a finding.

If a break glass or service account remains, this must be documented and approved by the AO. Otherwise, this is a finding.

Fix Text

Navigate to the local account configuration function within the application and remove all local accounts.

For break glass or service accounts, apply the appropriate password complexity per policy.