DISA_F5_BIG-IP_Device_Management_11_v1r7.audit from DISA F5 BIG-IP Device Management 11.x v1r7 STIG

F5BI-DM-000003 - The BIG-IP appliance must limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number - 1 for each administrator account and/or administrator account type.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-74521r2_rule

STIG-ID|F5BI-DM-000003

Vuln-ID|V-60091

F5BI-DM-000007 - The BIG-IP appliance must be configured to initiate a session lock after a 10-minute period of inactivity.

800-53|AC-12

CCI|CCI-000057

Rule-ID|SV-74523r2_rule

STIG-ID|F5BI-DM-000007

Vuln-ID|V-60093

F5BI-DM-000013 - The BIG-IP appliance must provide automated support for account management functions.

800-53|IA-2

CCI|CCI-000015

Rule-ID|SV-74525r1_rule

STIG-ID|F5BI-DM-000013

Vuln-ID|V-60095

F5BI-DM-000015 - The BIG-IP appliance must automatically remove or disable temporary user accounts after 72 hours.

CCI|CCI-000016

Rule-ID|SV-74527r1_rule

STIG-ID|F5BI-DM-000015

Vuln-ID|V-60097

F5BI-DM-000017 - The BIG-IP appliance must automatically disable accounts after a 35-day period of account inactivity.

CCI|CCI-000017

Rule-ID|SV-74529r1_rule

STIG-ID|F5BI-DM-000017

Vuln-ID|V-60099

F5BI-DM-000019 - The BIG-IP appliance must automatically audit account creation.

CCI|CCI-000018

Rule-ID|SV-74533r1_rule

STIG-ID|F5BI-DM-000019

Vuln-ID|V-60103

F5BI-DM-000021 - The BIG-IP appliance must automatically audit account modification.

CCI|CCI-001403

Rule-ID|SV-74535r1_rule

STIG-ID|F5BI-DM-000021

Vuln-ID|V-60105

F5BI-DM-000023 - The BIG-IP appliance must automatically audit account-disabling actions.

CCI|CCI-001404

Rule-ID|SV-74537r1_rule

STIG-ID|F5BI-DM-000023

Vuln-ID|V-60107

F5BI-DM-000025 - The BIG-IP appliance must automatically audit account removal actions.

CCI|CCI-001405

Rule-ID|SV-74539r1_rule

STIG-ID|F5BI-DM-000025

Vuln-ID|V-60109

F5BI-DM-000027 - The BIG-IP appliance must be configured to enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device.

CAT|I

CCI|CCI-000213

Rule-ID|SV-74541r1_rule

STIG-ID|F5BI-DM-000027

Vuln-ID|V-60111

F5BI-DM-000031 - The BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.

CCI|CCI-000044

Rule-ID|SV-74543r1_rule

STIG-ID|F5BI-DM-000031

Vuln-ID|V-60113

F5BI-DM-000033 - The BIG-IP appliance must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device - Banner Enabled

800-53|AC-8

CAT|III

CCI|CCI-000048

Rule-ID|SV-74671r1_rule

STIG-ID|F5BI-DM-000033

Vuln-ID|V-60241

F5BI-DM-000033 - The BIG-IP appliance must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device - Banner Text

F5BI-DM-000037 - Upon successful logon, the BIG-IP appliance must be configured to notify the administrator of the date and time of the last logon.

CCI|CCI-000052

CCI|CCI-000366

Rule-ID|SV-74545r1_rule

STIG-ID|F5BI-DM-000037

Vuln-ID|V-60115

F5BI-DM-000039 - Upon successful logon, the BIG-IP appliance must be configured to notify the administrator of the number of unsuccessful logon attempts since the last successful logon.

CCI|CCI-000053

Rule-ID|SV-74547r1_rule

STIG-ID|F5BI-DM-000039

Vuln-ID|V-60117

F5BI-DM-000043 - The BIG-IP appliance must be configured to protect against an individual (or process acting on behalf of an individual) falsely denying having performed system configuration changes.

CCI|CCI-000166

Rule-ID|SV-74551r1_rule

STIG-ID|F5BI-DM-000043

Vuln-ID|V-60121

F5BI-DM-000067 - The BIG-IP appliance must be configured to alert the ISSO and SA (at a minimum) in the event of an audit processing failure - at a minimum in the event of an audit processing failure.

800-53|SI-4(5)

CCI|CCI-000139

Rule-ID|SV-74553r1_rule

STIG-ID|F5BI-DM-000067

Vuln-ID|V-60123

F5BI-DM-000069 - The BIG-IP appliance must be configured to shut down by default upon audit failure (or restart when availability is an overriding concern) - or restart when availability is an overriding concern.

800-53|AU-5

CCI|CCI-000140

Rule-ID|SV-74555r1_rule

STIG-ID|F5BI-DM-000069

Vuln-ID|V-60125

F5BI-DM-000073 - The BIG-IP appliance must be configured to protect audit information from any type of unauthorized read access.

CCI|CCI-000162

Rule-ID|SV-74557r1_rule

STIG-ID|F5BI-DM-000073

Vuln-ID|V-60127

F5BI-DM-000075 - The BIG-IP appliance must be configured to protect audit information from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-74559r1_rule

STIG-ID|F5BI-DM-000075

Vuln-ID|V-60129

F5BI-DM-000077 - The BIG-IP appliance must be configured to protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-74561r1_rule

STIG-ID|F5BI-DM-000077

Vuln-ID|V-60131

F5BI-DM-000079 - The BIG-IP appliance must be configured to protect audit tools from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-74563r1_rule

STIG-ID|F5BI-DM-000079

Vuln-ID|V-60133

F5BI-DM-000085 - The BIG-IP appliance must be configured to back up audit records at least every seven (7) days onto a different system or system component than the system or component being audited.

800-53|AU-9(2)

CCI|CCI-001348

Rule-ID|SV-74565r1_rule

STIG-ID|F5BI-DM-000085

Vuln-ID|V-60135

F5BI-DM-000087 - The BIG-IP appliance must be configured to use NIAP evaluated cryptographic mechanisms to protect the integrity of audit information at rest.

800-53|AU-9(3)

CCI|CCI-001350

Rule-ID|SV-74567r2_rule

STIG-ID|F5BI-DM-000087

Vuln-ID|V-60137

F5BI-DM-000093 - The BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-74569r1_rule

STIG-ID|F5BI-DM-000093

Vuln-ID|V-60139

F5BI-DM-000095 - The BIG-IP appliance must be configured to uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).

CCI|CCI-000764

Rule-ID|SV-74573r1_rule

STIG-ID|F5BI-DM-000095

Vuln-ID|V-60143

F5BI-DM-000101 - The BIG-IP appliance must be configured to ensure administrators are authenticated with an individual authenticator prior to using a group authenticator.

800-53|IA-2(5)

CCI|CCI-000770

Rule-ID|SV-74575r1_rule

STIG-ID|F5BI-DM-000101

Vuln-ID|V-60145

F5BI-DM-000107 - The BIG-IP appliance must be configured to enforce a minimum 15-character password length.

CCI|CCI-000205

Rule-ID|SV-74577r1_rule

STIG-ID|F5BI-DM-000107

Vuln-ID|V-60147

F5BI-DM-000109 - The BIG-IP appliance must be configured to prohibit password reuse for a minimum of five generations.

CCI|CCI-000200

Rule-ID|SV-74579r1_rule

STIG-ID|F5BI-DM-000109

Vuln-ID|V-60149

F5BI-DM-000111 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-74679r1_rule

STIG-ID|F5BI-DM-000111

Vuln-ID|V-60249

F5BI-DM-000113 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-74581r1_rule

STIG-ID|F5BI-DM-000113

Vuln-ID|V-60151

F5BI-DM-000115 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-74681r1_rule

STIG-ID|F5BI-DM-000115

Vuln-ID|V-60251

F5BI-DM-000117 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-74583r1_rule

STIG-ID|F5BI-DM-000117

Vuln-ID|V-60153

F5BI-DM-000119 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must require that when a password is changed, the characters are changed in at least eight (8) of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-74585r2_rule

STIG-ID|F5BI-DM-000119

Vuln-ID|V-60155

F5BI-DM-000121 - The BIG-IP appliance must only store encrypted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-74587r1_rule

STIG-ID|F5BI-DM-000121

Vuln-ID|V-60157

F5BI-DM-000123 - The BIG-IP appliance must only transmit encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-74589r1_rule

STIG-ID|F5BI-DM-000123

Vuln-ID|V-60159

F5BI-DM-000125 - The BIG-IP appliance must be configured to enforce 24 hours/1 day as the minimum password lifetime.

CCI|CCI-000198

Rule-ID|SV-74683r1_rule

STIG-ID|F5BI-DM-000125

Vuln-ID|V-60253

F5BI-DM-000127 - The BIG-IP appliance must be configured to enforce a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-74591r1_rule

STIG-ID|F5BI-DM-000127

Vuln-ID|V-60161

F5BI-DM-000133 - The BIG-IP appliance must be configured to obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

Detections

Analytics

DISA F5 BIG-IP Device Management 11.x STIG v1r7

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Jun 2, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Apr 28, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Sep 29, 2020 Miscellaneous References updated.