CASA-ND-000010 - The Cisco ASA must be configured to limit the number of concurrent management sessions to an organization-defined number.

CAT|II

CCI|CCI-000054

Rule-ID|SV-239896r666051_rule

STIG-ID|CASA-ND-000010

Vuln-ID|V-239896

CASA-ND-000090 - The Cisco ASA must be configured to automatically audit account creation - Buffer Enabled

CCI|CCI-000018

Rule-ID|SV-239897r666054_rule

STIG-ID|CASA-ND-000090

Vuln-ID|V-239897

CASA-ND-000090 - The Cisco ASA must be configured to automatically audit account creation - logging enable

CASA-ND-000100 - The Cisco ASA must be configured to automatically audit account modification - Buffer Enabled

CCI|CCI-001403

Rule-ID|SV-239898r666057_rule

STIG-ID|CASA-ND-000100

Vuln-ID|V-239898

CASA-ND-000100 - The Cisco ASA must be configured to automatically audit account modification - logging enabled

CASA-ND-000110 - The Cisco ASA must be configured to automatically audit account-disabling actions - Buffer Enabled

CCI|CCI-001404

Rule-ID|SV-239899r682909_rule

STIG-ID|CASA-ND-000110

Vuln-ID|V-239899

CASA-ND-000110 - The Cisco ASA must be configured to automatically audit account-disabling actions - logging enabled

CASA-ND-000120 - The Cisco ASA must be configured to automatically audit account removal actions - Buffer Enabled

CCI|CCI-001405

Rule-ID|SV-239900r666063_rule

STIG-ID|CASA-ND-000120

Vuln-ID|V-239900

CASA-ND-000120 - The Cisco ASA must be configured to automatically audit account removal actions - logging enabled

CASA-ND-000140 - The Cisco ASA must be configured to enforce approved authorizations for controlling the flow of management information within the Cisco ASA based on information flow control policies.

CCI|CCI-001368

Rule-ID|SV-239901r666066_rule

STIG-ID|CASA-ND-000140

Vuln-ID|V-239901

CASA-ND-000160 - The Cisco ASA must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CCI|CCI-000048

Rule-ID|SV-239902r666069_rule

STIG-ID|CASA-ND-000160

Vuln-ID|V-239902

CASA-ND-000210 - The Cisco ASA must be configured to protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation - buffered informational

CCI|CCI-000166

Rule-ID|SV-239903r666072_rule

STIG-ID|CASA-ND-000210

Vuln-ID|V-239903

CASA-ND-000210 - The Cisco ASA must be configured to protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation - logging enable

CASA-ND-000240 - The Cisco ASA must be configured to generate audit records when successful/unsuccessful attempts to access privileges occur - buffered informational

CCI|CCI-000172

Rule-ID|SV-239904r666075_rule

STIG-ID|CASA-ND-000240

Vuln-ID|V-239904

CASA-ND-000240 - The Cisco ASA must be configured to generate audit records when successful/unsuccessful attempts to access privileges occur - logging enable

CASA-ND-000260 - The Cisco ASA must be configured to produce audit log records containing sufficient information to establish what type of event occurred - buffered informational

CCI|CCI-000130

Rule-ID|SV-239905r666078_rule

STIG-ID|CASA-ND-000260

Vuln-ID|V-239905

CASA-ND-000260 - The Cisco ASA must be configured to produce audit log records containing sufficient information to establish what type of event occurred - logging enable

CASA-ND-000270 - The Cisco ASA must be configured to produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-239906r666081_rule

STIG-ID|CASA-ND-000270

Vuln-ID|V-239906

CASA-ND-000280 - The Cisco ASA must be configured to produce audit records containing information to establish where the events occurred - buffered informational

CCI|CCI-000132

Rule-ID|SV-239907r666084_rule

STIG-ID|CASA-ND-000280

Vuln-ID|V-239907

CASA-ND-000280 - The Cisco ASA must be configured to produce audit records containing information to establish where the events occurred - logging enable

CASA-ND-000290 - The Cisco ASA must be configured to produce audit log records containing information to establish the source of events - buffered informational

CCI|CCI-000133

Rule-ID|SV-239908r666087_rule

STIG-ID|CASA-ND-000290

Vuln-ID|V-239908

CASA-ND-000290 - The Cisco ASA must be configured to produce audit log records containing information to establish the source of events - logging enable

CASA-ND-000300 - The Cisco ASA must be configured to produce audit records that contain information to establish the outcome of the event - buffered informational

CCI|CCI-000134

Rule-ID|SV-239909r666090_rule

STIG-ID|CASA-ND-000300

Vuln-ID|V-239909

CASA-ND-000300 - The Cisco ASA must be configured to produce audit records that contain information to establish the outcome of the event - logging enable

CASA-ND-000320 - The Cisco ASA must be configured to generate audit records containing the full-text recording of privileged commands - buffered informational

CCI|CCI-000135

Rule-ID|SV-239910r666093_rule

STIG-ID|CASA-ND-000320

Vuln-ID|V-239910

CASA-ND-000320 - The Cisco ASA must be configured to generate audit records containing the full-text recording of privileged commands - logging enable

CASA-ND-000430 - The Cisco ASA must be configured to prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services - HTTP

CAT|I

CCI|CCI-000382

Rule-ID|SV-239911r666096_rule

STIG-ID|CASA-ND-000430

Vuln-ID|V-239911

CASA-ND-000430 - The Cisco ASA must be configured to prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services - Telnet

CASA-ND-000450 - The Cisco ASA must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - serial

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-239912r851023_rule

STIG-ID|CASA-ND-000450

Vuln-ID|V-239912

CASA-ND-000450 - The Cisco ASA must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - ssh

CASA-ND-000450 - The Cisco ASA must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - username

CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - fips enabled

CCI|CCI-001941

Rule-ID|SV-239913r851024_rule

STIG-ID|CASA-ND-000470

Vuln-ID|V-239913

CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh cipher

CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh key-exchange

CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh version

CASA-ND-000490 - The Cisco ASA must be configured to enforce a minimum 15-character password length.

CCI|CCI-000205

Rule-ID|SV-239914r666105_rule

STIG-ID|CASA-ND-000490

Vuln-ID|V-239914

CASA-ND-000520 - The Cisco ASA must be configured to enforce password complexity by requiring that at least one uppercase character be used.

CCI|CCI-000192

Rule-ID|SV-239915r666108_rule

STIG-ID|CASA-ND-000520

Vuln-ID|V-239915

CASA-ND-000530 - The Cisco ASA must be configured to enforce password complexity by requiring that at least one lowercase character be used.

CCI|CCI-000193

Rule-ID|SV-239916r666111_rule

STIG-ID|CASA-ND-000530

Vuln-ID|V-239916

CASA-ND-000550 - The Cisco ASA must be configured to enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-239917r666114_rule

STIG-ID|CASA-ND-000550

Vuln-ID|V-239917

CASA-ND-000570 - The Cisco ASA must be configured to enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-239918r666117_rule

STIG-ID|CASA-ND-000570

Vuln-ID|V-239918

CASA-ND-000580 - The Cisco ASA must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-239919r666120_rule

STIG-ID|CASA-ND-000580

Vuln-ID|V-239919

CASA-ND-000690 - The Cisco ASA must be configured to terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements - console timeout

CCI|CCI-001133

Rule-ID|SV-239920r666196_rule

STIG-ID|CASA-ND-000690

Vuln-ID|V-239920

CASA-ND-000690 - The Cisco ASA must be configured to terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements - http server

CASA-ND-000690 - The Cisco ASA must be configured to terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

CASA-ND-000910 - The Cisco ASA must be configured to audit the execution of privileged functions - Buffer Enabled

CCI|CCI-002234

Rule-ID|SV-239921r851025_rule

STIG-ID|CASA-ND-000910

Vuln-ID|V-239921

CASA-ND-000910 - The Cisco ASA must be configured to audit the execution of privileged functions - logging enabled

CASA-ND-000920 - The Cisco ASA must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - maximum

CCI|CCI-001849

Rule-ID|SV-239922r851026_rule

STIG-ID|CASA-ND-000920

Vuln-ID|V-239922

CASA-ND-000920 - The Cisco ASA must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - minimum

CASA-ND-000930 - The Cisco ASA must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts - logging host

CCI|CCI-001858

Rule-ID|SV-239923r851027_rule

STIG-ID|CASA-ND-000930

Vuln-ID|V-239923

CASA-ND-000930 - The Cisco ASA must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts - logging trap

CASA-ND-000940 - The Cisco ASA must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - ntp server

CCI|CCI-001893

Rule-ID|SV-239924r877987_rule

STIG-ID|CASA-ND-000940

Vuln-ID|V-239924

CASA-ND-000940 - The Cisco ASA must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - ntp server prefer

CASA-ND-000970 - The Cisco ASA must be configured to record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

CCI|CCI-001889

Rule-ID|SV-239925r851029_rule

STIG-ID|CASA-ND-000970

Vuln-ID|V-239925

CASA-ND-000980 - The Cisco ASA must be configured to record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-239926r851031_rule

STIG-ID|CASA-ND-000980

Vuln-ID|V-239926

CASA-ND-001050 - The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - group

CCI|CCI-001967

Rule-ID|SV-239927r851032_rule

STIG-ID|CASA-ND-001050

Vuln-ID|V-239927

CASA-ND-001050 - The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - host

CASA-ND-001050 - The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - user

CASA-ND-001070 - The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm - group

Rule-ID|SV-239928r851033_rule

STIG-ID|CASA-ND-001070

Vuln-ID|V-239928

CASA-ND-001070 - The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm - host

CASA-ND-001070 - The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm - user

CASA-ND-001080 - The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based - md5

Rule-ID|SV-239929r851034_rule

STIG-ID|CASA-ND-001080

Vuln-ID|V-239929

CASA-ND-001080 - The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based - ntp authenticate

CASA-ND-001080 - The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based - ntp server

CASA-ND-001080 - The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based - ntp server prefer

Detections

Analytics

DISA STIG Cisco ASA NDM v1r3

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous