Home
Security Hardening
DISA F5 Big IP Access Policy Manager 11.x STIG V2R1

DISA F5 Big IP Access Policy Manager 11.x STIG V2R1

F5BI-AP-000003 – The BIG-IP APM module must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.
Details Successful authentication must not automatically give an entity access to an asset or security boundary. The lack of authorization-based...
F5BI-AP-000023 – The BIG-IP APM module must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to virtual servers.
Details Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification...
F5BI-AP-000025 – The BIG-IP APM module must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users accessing virtual servers acknowledge the usage conditions and take explicit actions to log on for further access.
Details The banner must be acknowledged by the user prior to allowing the user access to the network. This provides...
F5BI-AP-000027 – The BIG-IP APM module must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to publicly accessible applications.
Details Display of a standardized and approved use notification before granting access to the publicly accessible network element ensures privacy...
F5BI-AP-000073 – The BIG-IP APM module must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.
Details To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and...
F5BI-AP-000075 – The BIG-IP APM module must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or authentication, authorization, and accounting (AAA) server) that validate user account access authorizations and privileges when providing access control to virtual servers.
Details User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges....
F5BI-AP-000077 – The BIG-IP APM module must restrict user authentication traffic to specific authentication server(s) when providing user authentication to virtual servers – s when providing user auth to virtual servers.
Details User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can...
F5BI-AP-000079 – The BIG-IP APM module must use multifactor authentication for network access to non-privileged accounts.
Details To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
F5BI-AP-000195 – The BIG-IP APM module must be configured to require multifactor authentication for remote access with privileged accounts to virtual servers in such a way that one of the factors is provided by a device separate from the system gaining access.
Details For remote access to privileged accounts, the purpose of requiring a device that is separate from the information system...
F5BI-AP-000211 – The BIG-IP APM module must conform to FICAM-issued profiles.
Details Without conforming to Federal Identity, Credential, and Access Management (FICAM)-issued profiles, the information system may not be interoperable with...

DISA F5 Big IP Access Policy Manager 11.x STIG V2R1

F5BI-AP-000003 – The BIG-IP APM module must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.

F5BI-AP-000023 – The BIG-IP APM module must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to virtual servers.

F5BI-AP-000025 – The BIG-IP APM module must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users accessing virtual servers acknowledge the usage conditions and take explicit actions to log on for further access.

F5BI-AP-000027 – The BIG-IP APM module must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to publicly accessible applications.

F5BI-AP-000073 – The BIG-IP APM module must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.

F5BI-AP-000077 – The BIG-IP APM module must restrict user authentication traffic to specific authentication server(s) when providing user authentication to virtual servers – s when providing user auth to virtual servers.

F5BI-AP-000079 – The BIG-IP APM module must use multifactor authentication for network access to non-privileged accounts.

F5BI-AP-000195 – The BIG-IP APM module must be configured to require multifactor authentication for remote access with privileged accounts to virtual servers in such a way that one of the factors is provided by a device separate from the system gaining access.

F5BI-AP-000211 – The BIG-IP APM module must conform to FICAM-issued profiles.