The Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored.
An XCCDF Rule
Description
<VulnDiscussion>This requirement is intended to address the confidentiality and integrity of system information at rest (e.g., network device rule sets) when it is located on a storage device within the network device or as a component of the network device. This protection is required to prevent unauthorized alteration, corruption, or disclosure of information when not stored directly on the network device. Access to device configuration, system files, and other files stored locally are restricted to administrators by design. Admin accounts must be part of an administrator group and the group has associated authorizations based on role. There are 12 pre-defined admin roles and additional groups may be added. By default, the username for a CLI admin user is admin, and the password is defined during setup. There is no default password. This CLI admin user is the default admin user, and this user account cannot be deleted. Create web administrator account as the Account of Last Resort and add to the default Super Admin group. This will allow at least one user to be able to delete other admins and perform special functions via the web management tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-242659r879642_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Create a local web-based administrator. ONLY one web-based admin account should exist on the local device. The default CLI account is also local and cannot be removed.
1. Choose Administration >> System >> Admin Access >> Administrators >> Admin Users >> Add.
2. From the drop-down, choose "Create an Admin User".
3. Enter the admin name and other information.
4. Add the Super User group.