About automated support for account management
Rule Title: RiOS must provide automated support for account management functions.
STIG ID: RICX-DM-000001
Rule ID: SV-77279r1_rule Severity: CAT II
Vuln ID: V-62789 Class: Unclass
Account management functions include:
• assignment of group or role membership.
• identifying account type.
• specifying user access authorizations (that is, privileges).
• account removal, update, or termination.
• administrative alerts.
The network device must be configured to automatically provide account management functions, and these functions must immediately enforce the organization's current account policy.
All accounts used for access to the network device are privileged or system-level accounts. Therefore, if account management functions are not automatically enforced, an attacker could gain privileged access to a vital element of the network security architecture.
This control does not include emergency administration accounts that provide access to the network device components in case of network failure. There must be only one such locally defined account.
All other accounts must be defined. All other accounts must be created and managed on the site's authentication server (for example, RADIUS, LDAP, or Active Directory). This requirement is applicable to account management functions provided by the network device application. If the function is provided by the underlying OS or an authentication server, it must be secured using the applicable security guide or STIG.