HPE Aruba Networking AOS NDM Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000516-NDM-000334
Group -
AOS must generate log records for a locally developed list of auditable events.
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity th...Rule Medium Severity -
SRG-APP-000516-NDM-000336
Group -
SRG-APP-000516-NDM-000340
Group -
SRG-APP-000516-NDM-000341
Group -
AOS must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configur...Rule Medium Severity -
SRG-APP-000516-NDM-000344
Group -
AOS must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by Office of Management and Budget policy. For federal agencies operating a lega...Rule Medium Severity -
SRG-APP-000148-NDM-000346
Group -
AOS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
Authentication for administrative (privileged-level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server i...Rule Medium Severity -
SRG-APP-000395-NDM-000347
Group -
SRG-APP-000516-NDM-000350
Group -
AOS must limit the number of concurrent sessions to a maximum of three for each administrator account and/or administrator account type.
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administr...Rule Medium Severity -
AOS must automatically audit account creation.
Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Noti...Rule Medium Severity -
AOS must be configured to assign appropriate user roles or access levels to authenticated users.
Successful identification and authentication must not automatically give an entity full access to a network device or security domain. The lack of authorization-based access control could result in...Rule High Severity -
AOS must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.
A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If management information flow is not enforced based on approved autho...Rule Medium Severity -
AOS must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device.
Display of the DOD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executi...Rule Medium Severity -
AOS must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
The banner must be acknowledged by the administrator prior to the device allowing the administrator access to the network device. This provides assurance that the administrator has seen the message...Rule Medium Severity -
AOS must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused o...Rule High Severity -
AOS must implement replay-resistant authentication mechanisms for network access to privileged accounts.
A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.