SPLK-CL-000045 - Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DOD common access card (CAC) or other smart card credential for identity management, personal authentication, and multifactor authentication.

Information

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.

DOD has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as a primary component of layered protection for national security systems.

If the application cannot meet this requirement, the risk may be mitigated through use of an authentication server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure an SSO proxy service using Apache, IIS, F5, SAML, etc., to provide CAC credentials to Splunk Enterprise.

Examples for Apache and F5 are provided using the supplemental documentation included in this package to be used in addition to the Splunk documentation.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Splunk_Enterprise_7-x_for_Windows_V3R1_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(12), CAT|II, CCI|CCI-001953, CCI|CCI-004047, Rule-ID|SV-221605r992017_rule, STIG-ID|SPLK-CL-000045, STIG-Legacy|SV-111313, STIG-Legacy|V-102359, Vuln-ID|V-221605

Plugin: Splunk

Control ID: dd19d682f71355ab0b280f6cc644c6c2b066b623a3bc9e7cb062cc255da6df48