Details
Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization’s security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.
NOTE: This Nessus check is looking for the minimal presence of local authentication for administrative access to the device. If you implement AAA services in your environment this check may need to be modified to account for the utilization of AAA services.
Solution
Configure the network devices so it will require a password to gain administrative access to the device.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Cisco.
References
- 800-53|IA-2.
- CAT|I
- Rule-ID|SV-3012r4_rule
- STIG-ID|NET0230
- Vuln-ID|V-3012