F5BI-DM-000171 - The BIG-IP appliance must be configured to automatically audit account-enabling actions.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail that documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO). Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


Configure the BIG-IP appliance to use a properly configured remote authentication server to automatically audit account-enabling actions.

See Also


Item Details

References: CAT|II, CCI|CCI-002130, Rule-ID|SV-217410r879696_rule, STIG-ID|F5BI-DM-000171, STIG-Legacy|SV-74617, STIG-Legacy|V-60187, Vuln-ID|V-217410

Plugin: F5

Control ID: 8f531ec7da24b32099f09e02aefe4db39f11ea86bd0076268dca47bbce803c09