GEN009120 - The system, if capable, must be configured to require the use of a CAC, PIV compliant hardware token, or Alternate Logon Token (ALT) for authentication.

Information

In accordance with CTO 07-015 PKI authentication is required. This provides stronger, two-factor authentication than using a username/password.

NOTE: The following are exempt from this, however, they must meet all password requirements and must be documented with the IAO:

- Stand-alone systems.
- Application Accounts.
- Students or unpaid employees (such as, interns) who are not eligible to receive or not in receipt of a CAC, PIV, or ALT.
- Warfighters and support personnel located at operational tactical locations conducting wartime operations that are not collocated with RAPIDS workstations to issue CAC; are not eligible for CAC or do not have the capability to use ALT.
- Test systems that have an Interim Approval to Test (IATT) and provide protection via separate VPN, firewall, or security measures preventing access to network and system components from outside the protection boundary documented in the IATT.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Consult vendor documentation to determine the procedures necessary for configuring CAC authentication. Configure all accounts required by policy to use CAC authentication.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_10_x86_V2R2_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(4), CAT|II, CCI|CCI-000768, Rule-ID|SV-227988r603266_rule, STIG-ID|GEN009120, STIG-Legacy|SV-30004, STIG-Legacy|V-24347, Vuln-ID|V-227988

Plugin: Unix

Control ID: c612009ac9cdaa2368659786512c509d833498a63b6f753ae5cfe2fa47b7c55e