HPE Aruba Networking AOS NDM Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000001-NDM-000200
Group -
SRG-APP-000026-NDM-000208
Group -
SRG-APP-000033-NDM-000212
Group -
SRG-APP-000097-NDM-000227
Group -
SRG-APP-000065-NDM-000214
Group -
AOS must be configured to enforce the limit of three consecutive invalid login attempts, after which time it must block any login attempt for 15 minutes.
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.Rule Medium Severity -
SRG-APP-000068-NDM-000215
Group -
SRG-APP-000069-NDM-000216
Group -
SRG-APP-000142-NDM-000245
Group -
SRG-APP-000149-NDM-000247
Group -
AOS must be configured to use DOD public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.
MFA is when two or more factors are used to confirm the identity of an individual who is requesting access to digital information resources. Valid factors include something the individual knows (e....Rule High Severity -
SRG-APP-000156-NDM-000250
Group -
SRG-APP-000164-NDM-000252
Group -
SRG-APP-000166-NDM-000254
Group -
SRG-APP-000167-NDM-000255
Group -
AOS must enforce password complexity by requiring that at least one lowercase character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000168-NDM-000256
Group -
SRG-APP-000169-NDM-000257
Group -
AOS must enforce password complexity by requiring that at least one special character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000172-NDM-000259
Group -
AOS must transmit only encrypted representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily c...Rule High Severity -
SRG-APP-000175-NDM-000262
Group -
SRG-APP-000179-NDM-000265
Group -
SRG-APP-000190-NDM-000267
Group -
SRG-APP-000329-NDM-000287
Group -
AOS must enforce role-based access control policies over defined subjects and objects.
Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organ...Rule Medium Severity -
SRG-APP-000343-NDM-000289
Group -
AOS must audit the execution of privileged functions.
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and...Rule Medium Severity -
SRG-APP-000360-NDM-000295
Group -
AOS must generate an immediate real-time alert of all audit failure events requiring real-time alerts.
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impe...Rule Medium Severity -
SRG-APP-000373-NDM-000298
Group -
SRG-APP-000374-NDM-000299
Group -
AOS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).Rule Medium Severity -
SRG-APP-000395-NDM-000310
Group -
SRG-APP-000400-NDM-000313
Group -
AOS must prohibit the use of cached authenticators after an organization-defined time period.
Some authentication implementations can be configured to use cached authenticators. If cached authentication information is out of date, the validity of the authentication information may be que...Rule Medium Severity -
SRG-APP-000435-NDM-000315
Group -
SRG-APP-000515-NDM-000325
Group -
AOS must off-load audit records onto a different system or media than the system being audited.
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.Rule Medium Severity -
SRG-APP-000170-NDM-000329
Group -
SRG-APP-000516-NDM-000334
Group -
AOS must generate log records for a locally developed list of auditable events.
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity th...Rule Medium Severity -
SRG-APP-000516-NDM-000336
Group -
SRG-APP-000516-NDM-000340
Group -
SRG-APP-000516-NDM-000341
Group -
AOS must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configur...Rule Medium Severity -
SRG-APP-000516-NDM-000344
Group -
AOS must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by Office of Management and Budget policy. For federal agencies operating a lega...Rule Medium Severity -
SRG-APP-000148-NDM-000346
Group -
AOS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
Authentication for administrative (privileged-level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server i...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.