F5BI-DM-300001 - The F5 BIG-IP appliance must be configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number.

800-53|AC-10

800-53|SC-5

CAT|II

CCI|CCI-000054

CCI|CCI-002385

Rule-ID|SV-266064r1024595_rule

STIG-ID|F5BI-DM-300001

Vuln-ID|V-266064

F5BI-DM-300003 - The F5 BIG-IP appliance must terminate shared/group account credentials when members leave the group.

800-53|AC-2(10)

CCI|CCI-002142

Rule-ID|SV-266065r1024596_rule

STIG-ID|F5BI-DM-300003

Vuln-ID|V-266065

F5BI-DM-300009 - The F5 BIG-IP appliance must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

800-53|AC-2(7)(a)

800-53|AC-2a.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-266066r1051115_rule

STIG-ID|F5BI-DM-300009

Vuln-ID|V-266066

F5BI-DM-300010 - The F5 BIG-IP appliance must be configured to assign appropriate user roles or access levels to authenticated users.

800-53|AC-3

800-53|AC-3(7)

800-53|CM-6b.

CAT|I

CCI|CCI-000213

CCI|CCI-000366

CCI|CCI-002169

Rule-ID|SV-266067r1024598_rule

STIG-ID|F5BI-DM-300010

Vuln-ID|V-266067

F5BI-DM-300012 - The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.

800-53|AC-2(4)

800-53|AC-6(9)

800-53|AU-3

800-53|AU-3(1)

800-53|AU-10

800-53|AU-12a.

800-53|AU-12c.

800-53|CM-5(1)

CCI|CCI-000018

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000166

CCI|CCI-000169

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001405

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-002130

CCI|CCI-002234

Rule-ID|SV-266068r1029557_rule

STIG-ID|F5BI-DM-300012

Vuln-ID|V-266068

F5BI-DM-300013 - The F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-266069r1024600_rule

STIG-ID|F5BI-DM-300013

Vuln-ID|V-266069

F5BI-DM-300014 - The F5 BIG-IP appliance must be configured to display the Standard Mandatory DOD Notice and Consent Banner upon access to the TMOS User Interface.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-266070r1024881_rule

STIG-ID|F5BI-DM-300014

Vuln-ID|V-266070

F5BI-DM-300033 - The F5 BIG-IP appliance must manage local audit storage capacity in accordance with organization-defined audit record storage requirements.

800-53|AU-4

CAT|III

CCI|CCI-001849

Rule-ID|SV-266074r1024605_rule

STIG-ID|F5BI-DM-300033

Vuln-ID|V-266074

F5BI-DM-300034 - The F5 BIG-IP appliance must generate audit records and send records to redundant central syslog servers that are separate from the appliance.

800-53|AU-4(1)

800-53|AU-5(2)

800-53|SI-2c.

CCI|CCI-001851

CCI|CCI-001858

CCI|CCI-002605

Rule-ID|SV-266075r1024607_rule

STIG-ID|F5BI-DM-300034

Vuln-ID|V-266075

F5BI-DM-300037 - The F5 BIG-IP appliance must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).

800-53|AU-8b.

CCI|CCI-001890

Rule-ID|SV-266077r1024609_rule

STIG-ID|F5BI-DM-300037

Vuln-ID|V-266077

F5BI-DM-300039 - The F5 BIG-IP appliance must be configured to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

800-53|CM-5(3)

CCI|CCI-001749

Rule-ID|SV-266078r1024610_rule

STIG-ID|F5BI-DM-300039

Vuln-ID|V-266078

F5BI-DM-300040 - The F5 BIG-IP appliance must be configured to use at least two authentication servers to authenticate administrative users.

800-53|CM-6(1)

CCI|CCI-000370

Rule-ID|SV-266079r1024884_rule

STIG-ID|F5BI-DM-300040

Vuln-ID|V-266079

F5BI-DM-300041 - The F5 BIG-IP appliance must be running an operating system release that is currently supported by the vendor.

Rule-ID|SV-266080r1024886_rule

STIG-ID|F5BI-DM-300041

Vuln-ID|V-266080

F5BI-DM-300044 - The F5 BIG-IP appliance must obtain its public key certificates from an appropriate certificate policy through an approved service provider.

800-53|SC-17

CCI|CCI-001159

Rule-ID|SV-266083r1024615_rule

STIG-ID|F5BI-DM-300044

Vuln-ID|V-266083

F5BI-DM-300045 - The F5 BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-266084r1043177_rule

STIG-ID|F5BI-DM-300045

Vuln-ID|V-266084

F5BI-DM-300046 - The F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins.

800-53|IA-2

800-53|IA-2(1)

800-53|IA-2(5)

800-53|IA-5(2)(c)

CCI|CCI-000187

CCI|CCI-000764

CCI|CCI-000765

CCI|CCI-000770

Rule-ID|SV-266085r1113746_rule

STIG-ID|F5BI-DM-300046

Vuln-ID|V-266085

F5BI-DM-300048 - The F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

800-53|IA-3(1)

CCI|CCI-001967

Rule-ID|SV-266086r1024925_rule

STIG-ID|F5BI-DM-300048

Vuln-ID|V-266086

F5BI-DM-300049 - The F5 BIG-IP appliance must enforce a minimum 15-character password length.

800-53|IA-5(1)(a)

CCI|CCI-000205

Rule-ID|SV-266087r1024891_rule

STIG-ID|F5BI-DM-300049

Vuln-ID|V-266087

F5BI-DM-300050 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one uppercase character be used.

CCI|CCI-000192

Rule-ID|SV-266088r1024894_rule

STIG-ID|F5BI-DM-300050

Vuln-ID|V-266088

F5BI-DM-300051 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one lowercase character be used.

CCI|CCI-000193

Rule-ID|SV-266089r1024622_rule

STIG-ID|F5BI-DM-300051

Vuln-ID|V-266089

F5BI-DM-300052 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-266090r1024623_rule

STIG-ID|F5BI-DM-300052

Vuln-ID|V-266090

F5BI-DM-300053 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-266091r1024624_rule

STIG-ID|F5BI-DM-300053

Vuln-ID|V-266091

F5BI-DM-300054 - The F5 BIG-IP appliance must require that when a password is changed, the characters are changed in at least eight of the positions within the password.

800-53|IA-5(1)(b)

CCI|CCI-000195

Rule-ID|SV-266092r1043189_rule

STIG-ID|F5BI-DM-300054

Vuln-ID|V-266092

F5BI-DM-300055 - The F5 BIG-IP appliance must prohibit the use of cached authenticators after eight hours or less.

800-53|IA-5(13)

CCI|CCI-002007

Rule-ID|SV-266093r1024899_rule

STIG-ID|F5BI-DM-300055

Vuln-ID|V-266093

F5BI-DM-300056 - The F5 BIG-IP appliance must be configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-266094r1024902_rule

STIG-ID|F5BI-DM-300056

Vuln-ID|V-266094

F5BI-DM-300057 - The F5 BIG-IP appliance must set the idle time before automatic logout to five minutes of inactivity except to fulfill documented and validated mission requirements.

800-53|AC-11a.

800-53|SC-10

CCI|CCI-000057

CCI|CCI-001133

Rule-ID|SV-266095r1024904_rule

STIG-ID|F5BI-DM-300057

Vuln-ID|V-266095

F5BI-DM-300060 - The F5 BIG-IP appliance must conduct backups of the configuration at a weekly or organization-defined frequency and store on a separate device.

800-53|CP-9c.

CCI|CCI-000539

Rule-ID|SV-266096r1024630_rule

STIG-ID|F5BI-DM-300060

Detections

Analytics

DISA F5 BIG-IP TMOS NDM STIG v1r2

Audit Details

File Details

Audit Changelog

No revisions found