Access to the Hardware Management Console must be restricted to only authorized personnel.
An XCCDF Rule
Description
<VulnDiscussion>Access to the Hardware Management Console if not properly restricted to authorized personnel could lead to a bypass of security, access to the system, and an altering of the environment. This would result in a loss of secure operations and can cause an impact to data operating environment integrity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Manager</Responsibility><Responsibility>Security Manager</Responsibility><IAControls>ECLP-1, PECF-1, PECF-2, PRMP-1, PRMP-2</IAControls>
- ID
- SV-30008r2_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
The System Administrator will see that sign-on access to the Hardware Management Console is restricted to authorized personnel and that a DD2875 is on file for each user ID.
Note: Sites must have a list of valid HMC users, indicating their USER IDs, Date of DD2875, and roles and responsibilities.
The System Administrator must see that the list and users defined to the Hardware Management Console match.