Cisco IOS Router NDM Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000001-NDM-000200
Group -
SRG-APP-000026-NDM-000208
Group -
The Cisco router must be configured to automatically audit account creation.
Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notifica...Rule Medium Severity -
SRG-APP-000027-NDM-000209
Group -
The Cisco router must be configured to automatically audit account modification.
Since the accounts in the network device are privileged or system-level accounts, account management is vital to the security of the network device. Account management by a designated authority ens...Rule Medium Severity -
SRG-APP-000028-NDM-000210
Group -
The Cisco router must be configured to automatically audit account disabling actions.
Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account disabling actions will ...Rule Medium Severity -
SRG-APP-000029-NDM-000211
Group -
The Cisco router must be configured to automatically audit account removal actions.
Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account removal actions will su...Rule Medium Severity -
SRG-APP-000038-NDM-000213
Group -
SRG-APP-000065-NDM-000214
Group -
The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.Rule Medium Severity -
SRG-APP-000068-NDM-000215
Group -
The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
Display of the DoD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executi...Rule Medium Severity -
SRG-APP-000080-NDM-000345
Group -
The Cisco device must be configured to audit all administrator activity.
This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes ...Rule Medium Severity -
SRG-APP-000096-NDM-000226
Group -
SRG-APP-000097-NDM-000227
Group -
SRG-APP-000101-NDM-000231
Group -
The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.
Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. Organizations consider limiting the additional audit information to only ...Rule Medium Severity -
SRG-APP-000119-NDM-000236
Group -
The Cisco router must be configured to protect audit information from unauthorized modification.
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit network device activity. If audit data were to become compromised, ...Rule Medium Severity -
SRG-APP-000120-NDM-000237
Group -
The Cisco router must be configured to protect audit information from unauthorized deletion.
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. If audit data were to become compromis...Rule Medium Severity -
SRG-APP-000133-NDM-000244
Group -
SRG-APP-000142-NDM-000245
Group -
SRG-APP-000148-NDM-000346
Group -
The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
Authentication for administrative (privileged level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server i...Rule Medium Severity -
SRG-APP-000164-NDM-000252
Group -
SRG-APP-000166-NDM-000254
Group -
The Cisco router must be configured to enforce password complexity by requiring that at least one uppercase character be used.
Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisti...Rule Medium Severity -
SRG-APP-000167-NDM-000255
Group -
The Cisco router must be configured to enforce password complexity by requiring that at least one lowercase character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000168-NDM-000256
Group -
The Cisco router must be configured to enforce password complexity by requiring that at least one numeric character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000169-NDM-000257
Group -
SRG-APP-000170-NDM-000329
Group -
The Cisco router must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.
If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at ...Rule Medium Severity -
SRG-APP-000171-NDM-000258
Group -
The Cisco router must only store cryptographic representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily c...Rule High Severity -
SRG-APP-000190-NDM-000267
Group -
The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity.
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port th...Rule High Severity -
SRG-APP-000319-NDM-000283
Group -
SRG-APP-000357-NDM-000293
Group -
The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.
In order to ensure network devices have a sufficient storage capacity in which to write the audit logs, they need to be able to allocate audit record storage capacity. The task of allocating audit ...Rule Medium Severity -
SRG-APP-000360-NDM-000295
Group -
The Cisco router must be configured to generate an alert for all audit failure events.
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impe...Rule Medium Severity -
SRG-APP-000373-NDM-000298
Group -
SRG-APP-000395-NDM-000310
Group -
SRG-APP-000395-NDM-000310
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.