Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Cisco Secure Network Analytics (SNA) Security Technical Implementation Guide

V1R1 · · · Released 29 Jun 2026 · 31 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Sort by
b
The Cisco SNA appliance must be configured to limit the number of concurrent sessions to an organization-defined number for each administrator account.
AC-10 - Medium - CCI-000054 - V-284853 - SV-284853r1212030_rule
RMF Control
AC-10
Severity
M
CCI
CCI-000054
Version
CSNA-ND-000010
Vuln IDs
  • V-284853
Rule IDs
  • SV-284853r1212030_rule
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions.
Checks: C-89423r1212028_chk

Verify the Cisco SNA appliance is configured to limit the number of concurrent sessions to an organization-defined number for all administrator accounts. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Session Settings >> Maximum Number of Concurrent Sessions. If the Cisco SNA appliance is not configured to limit the number of concurrent sessions to an organization-defined number for each administrator account, this is a finding.

Fix: F-89328r1212029_fix

Configure the SNA appliance to limit the number of concurrent sessions to an organization-defined number for all administrator accounts and/or administrator account types. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Session Settings. Input Maximum Number of Concurrent Sessions. Apply Configuration.

c
The Cisco SNA appliance must be configured to assign appropriate user roles or access levels to authenticated users.
AC-3 - High - CCI-000213 - V-284862 - SV-284862r1227142_rule
RMF Control
AC-3
Severity
H
CCI
CCI-000213
Version
CSNA-ND-000100
Vuln IDs
  • V-284862
Rule IDs
  • SV-284862r1227142_rule
Successful identification and authentication must not automatically give an entity full access to a network device or security domain. The lack of authorization-based access control could result in the immediate compromise and unauthorized access to sensitive information. All DoW systems must be properly configured to incorporate access control methods that do not rely solely on authentication for authorized access. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset or set of resources. Information systems use access control policies and enforcement mechanisms to implement this requirement. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Some network devices are preconfigured with security groups. Other network devices enable operators to create custom security groups with custom permissions. For example, an information system security manager (ISSM) may require read-only access to audit the network device. Operators may create an audit security group, define permissions and access levels for members of the group, and then assign the ISSM's user persona to the audit security group. This is still considered privileged access, but the ISSM's security group is more restrictive than the network administrator's security group. Network devices that rely on AAA brokers for authentication and authorization services may need to identify the available security groups or access levels available on the network devices and convey that information to the AAA operator. Once the AAA broker identifies the user persona on the centralized directory service, the user's security group memberships can be retrieved. The AAA operator may need to create a mapping that links target security groups from the directory service to the appropriate security groups or access levels on the network device. Once these mappings are configured, authorizations can happen dynamically, based on each user's directory service group membership. This requirement also applies to Zero Trust initiatives. Satisfies: SRG-APP-000033-NDM-000212, SRG-APP-000153-NDM-000249, SRG-APP-000329-NDM-000287
Checks: C-89432r1212032_chk

Verify the Cisco SNA is configured to assign appropriate user roles to authenticated users. This requirement may be verified by demonstrating users logging in with various privilege levels. The configuration may also be compared as shown below: Navigate to SNA Dashboard >> Configure >> User Management >> Users >> Select a User >> Actions.... Examine the assigned Data Role. If the Cisco SNA appliance does not enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level, this is a finding.

Fix: F-89337r1212033_fix

Configure the Cisco SNA appliance to assign appropriate user roles or access levels to authenticated users: Navigate to SNA Dashboard >> Configure >> User Management >> Create Dropdown (Top Right) >> Data Role. Assign Data Read/Write privileges for the role. Save. Navigate to Users >> Select a User >> Actions.... Assign an appropriate Data Role.

b
The Cisco SNA appliance must be configured to enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.
AC-4 - Medium - CCI-001368 - V-284863 - SV-284863r1212037_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001368
Version
CSNA-ND-000110
Vuln IDs
  • V-284863
Rule IDs
  • SV-284863r1212037_rule
A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If management information flow is not enforced based on approved authorizations, the network device may become compromised. Information flow control regulates where management information is allowed to travel within a network device. The flow of all management information must be monitored and controlled so it does not introduce any unacceptable risk to the network device or data. Application-specific examples of enforcement occur in systems that employ rule sets or establish configuration settings that restrict information system services or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of management information within the system in accordance with applicable policy. This requirement also applies to Zero Trust initiatives. Satisfies: SRG-APP-000038-NDM-000213, SRG-APP-000435-NDM-000315
Checks: C-89433r1212035_chk

Review the Cisco SNA appliance Sysconfig configuration to determine if it enforces approved authorizations for controlling the flow of management information within the network device based on information flow control policies. Log in to the appliance console as sysadmin. Select Network >> Trusted Hosts. Verify only required trusted IPs/hosts are listed, including other SNA appliances. Note: The Trusted Hosts list acts as an access control list (ACL). If the Cisco SNA appliance does not enforce these approved authorizations, this is a finding.

Fix: F-89338r1212036_fix

Configure the Cisco SNA appliance to enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies. Log in to the appliance console as sysadmin. Select Network >> Trusted Hosts. Input only required trusted IPs/hosts, including other SNA appliances. Note: The Trusted Hosts list acts as an ACL.

b
The Cisco SNA appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
AC-7 - Medium - CCI-000044 - V-284864 - SV-284864r1205360_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
CSNA-ND-000120
Vuln IDs
  • V-284864
Rule IDs
  • SV-284864r1205360_rule
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.
Checks: C-89434r1205358_chk

Review the Cisco SNA appliance configuration to verify it enforces the limit of three consecutive invalid logon attempts. Navigate to Cisco SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Session Settings >> Number of Unsuccessful Attempts and Duration of Lockout. If the Cisco SNA appliance is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.

Fix: F-89339r1205359_fix

Configure the Cisco SNA appliance to enforce the limit of three consecutive invalid logon attempts during a 15-minute time period. Navigate to Cisco SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Session Settings. Input a number for "Number of Unsuccessful Attempts and Duration of Lockout". Apply the configuration.

b
The Cisco SNA appliance must be configured to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the device.
AC-8 - Medium - CCI-000048 - V-284865 - SV-284865r1227148_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
CSNA-ND-000130
Vuln IDs
  • V-284865
Rule IDs
  • SV-284865r1227148_rule
Display of the DoW-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users. Satisfies: SRG-APP-000068-NDM-000215, SRG-APP-000069-NDM-000216
Checks: C-89435r1227146_chk

Determine if the Cisco SNA appliance is configured to present a DoW-approved banner that is formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." This is verified by navigating to the appliance login page where the banner should be displayed and accepted by clicking "Continue". If the DoW banner is not displayed, this is a finding.

Fix: F-89340r1227147_fix

Configure the Cisco SNA appliance to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the device. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Opening Message. Enter the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Apply the configuration.

c
The Cisco SNA appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
CM-7 - High - CCI-000382 - V-284884 - SV-284884r1212060_rule
RMF Control
CM-7
Severity
H
CCI
CCI-000382
Version
CSNA-ND-000330
Vuln IDs
  • V-284884
Rule IDs
  • SV-284884r1212060_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems. Network devices are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the network device must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved. Some network devices have capabilities enabled by default; if these capabilities are not necessary, they must be disabled. If a particular capability is used, then it must be documented and approved.
Checks: C-89454r1212058_chk

Review the Cisco SNA appliance configuration to determine if it prohibits the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. Navigate to Cisco SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Appliance Tab >> SSH. Verify "Enable" is unchecked. Navigate to Network Services tab >> SNMP Agent. Verify "Enable" is unchecked if not needed by the organization. Navigate to Network Services tab >> Internet Proxy. Verify "Enable" is unchecked if not needed by the organization. Navigate to General Tab >> External Services. Verify "Enable" is unchecked if not needed by the organization. If any unnecessary or nonsecure functions are permitted, this is a finding.

Fix: F-89359r1212059_fix

Configure the Cisco SNA appliance to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. Navigate to Cisco SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Appliance Tab. Ensure "SSH" is unchecked. Navigate to Network Services tab >> SNMP Agent. Uncheck "Enable" if not needed by organization. Navigate to Network Services tab >> Internet Proxy. Uncheck "Enable" if not needed by organization. Navigate to General tab >> External Services. Uncheck "Enable" if not needed by organization. Click "Apply Settings".

b
The Cisco SNA appliance must be configured with only one local account to be used as the account of last resort if the authentication server is unavailable.
AC-2 - Medium - CCI-001358 - V-284885 - SV-284885r1212063_rule
RMF Control
AC-2
Severity
M
CCI
CCI-001358
Version
CSNA-ND-000340
Vuln IDs
  • V-284885
Rule IDs
  • SV-284885r1212063_rule
Authentication for administrative (privileged-level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary. The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit should be added to the envelope as a record. Administrators should secure the credentials and disable the root account (if possible) when not needed for system administration functions.
Checks: C-89455r1212061_chk

Review the Cisco SNA appliance configuration to determine if an account of last resort is configured. Verify the username and password for the account of last resort is contained within a sealed envelope and kept in a safe. Navigate to Cisco SNA Dashboard >> Configure >> User Management >> Users >> Select Account >> Actions... >> Edit. The authentication service should only be "local" for the "admin" account. Note: AAA centralized accounts are represented in this menu for role assignment, but cannot be logged into locally. If one local account does not exist for use as the account of last resort, this is a finding.

Fix: F-89360r1212062_fix

Configure the Cisco SNA appliance to use an account of last resort. Verify the username and password for the account of last resort is contained within a sealed envelope and kept in a safe. Navigate to Cisco SNA Dashboard >> Configure >> User Management >> Users >> Select Account >> Actions... >> Edit. The authentication service should only be "local" for the "admin" account. Delete all others. Note: AAA centralized accounts are represented in this menu for role assignment but cannot be logged into locally.

c
The Cisco SNA appliance must be configured to use DoW public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.
IA-2 - High - CCI-000765 - V-284886 - SV-284886r1227140_rule
RMF Control
IA-2
Severity
H
CCI
CCI-000765
Version
CSNA-ND-000350
Vuln IDs
  • V-284886
Rule IDs
  • SV-284886r1227140_rule
MFA is when two or more factors are used to confirm the identity of an individual requesting access to digital information resources. Valid factors include something the individual knows (e.g., username and password), something the individual has (e.g., a smartcard or token), or something the individual is (e.g., a fingerprint or biometric). Legacy information system environments only use a single factor for authentication, typically a username and password combination. Although two pieces of data are used in a username and password combination, this is still considered single factor because an attacker can obtain access simply by learning what the user knows. Common attacks against single-factor authentication are attacks on user passwords. These attacks include brute force password guessing, password spraying, and password credential stuffing. MFA, along with strong user account hygiene, helps mitigate against the threat of having account passwords discovered by an attacker. Even in the event of a password compromise, with MFA implemented and required for interactive login, the attacker still needs to acquire something the user has or replicate a piece of user's biometric digital presence. Private industry recognizes and uses a wide variety of MFA solutions. However, DoW PKI is the only prescribed method approved for DoW organizations to implement MFA. For authentication purposes, centralized DoW certificate authorities (CA) issue PKI certificate key pairs (public and private) to individuals using the prescribed x.509 format. The private certificates that have been generated by the issuing CA are downloaded and saved to smartcards which, within DoW, are referred to as common access cards (CAC) or personal identity verification (PIV) cards. This happens at designated DoW badge facilities. The CA maintains a record of the corresponding public keys for use with PKI-enabled environments. Privileged user smartcards, or "alternate tokens", function in the same manner, so this requirement applies to all interactive user sessions (authorized and privileged users). Note: This requirement is used in conjunction with the use of a centralized authentication server (e.g., AAA, RADIUS, LDAP), a separate but equally important requirement. The MFA configuration of this requirement provides identification and the first phase of authentication (the challenge and validated response, thereby confirming the PKI certificate that was presented by the user). The centralized authentication server will provide the second phase of authentication (the digital presence of the PKI ID as a valid user in the requested security domain) and authorization. The centralized authentication server will map validated PKI identities to valid user accounts and determine access levels for authenticated users based on security group membership and role. In cases where the centralized authentication server is not used by the network device for user authorization, the network device must map the authenticated identity to the user account for PKI-based authentication. Satisfies: SRG-APP-000149-NDM-000247, SRG-APP-000156-NDM-000250
Checks: C-89456r1227138_chk

Verify the Cisco SNA appliance is configured to use DoW PKI as MFA for interactive logins. Navigate to the login page and select Single Sign-on (SSO). At the SAML Identity Provider (IdP) login page, enter the certificate with PIN as managed by middleware, (e.g., ActivClient). Note: The MFA requirement is met by the SSO server and will require coordination with the server's administrator. If the Cisco SNA appliance is not configured to use SSO with DoW PKI as MFA for interactive logins, this is a finding. If the PKI authenticated user is not mapped to the effective local user account this is a finding.

Fix: F-89361r1227139_fix

Configure the network device to use SSO with DoW PKI as MFA for interactive logins. A. Prepare for Configuration. 1. The following information is required to configure SSO: - The IdP URL must use the fully qualified domain name or IPv4 address. - If the IdP URL starts with HTTPS, download the CA certificate. 2. Certificate Requirements: If the URL for downloading the IdP URL starts with HTTPS, confirm the certificate was added to the appliance Trust Stores. B. Configure the Service Provider. 1. Navigate to the management console webpage (SMC). 2. Log in as an admin with sufficient privileges. 3. Select Configure >> User Management. 4. Select Create (Dropdown) >> Authentication Service >> SSO. 5. Select IdP Type (Dropdown) >> Microsoft ADFS. 6. Enter the URL to download the IdP's configuration file. Requirements: Enter the fully qualified domain name or IP address. Alternatively, upload an Identity Provider Metadata XML File. 7. Select "Disable Requested Authentication Context". 8. Select Name Identifier Format >> Transient (if following schema note below). Otherwise, configure according to local format. 9. Add a Login Screen Label relevant to local configurations. 10. Select "Save". 11. When redirected to the Authentication and Authorization tab, it may take up to five minutes to apply changes and SSO Status to become "Ready". 12. Select Actions >> Enable SSO. C. Configure ADFS according to local procedure to add the Relying Party Trust. Note: For ADFS configuration, create and modify the following Claim Issuance Policy Custom Rule: c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = "http://YOURADFSFQDN./adfs/com/adfs/service/trust", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "https://YOURSNAFQDN/fedlet"); D. Add an SSO User. 1. Log in to the SMC Web UI. 2. Select Configure >> User Management >> Users >> Create User. 3. Complete the fields to create a new user. - Authentication Service: Select SSO. - User Name: Enter the first part of the email address for the IdP account. Ensure the ID is identical to the one that will be used for SSO at login. For example, for name@email.com, enter name in this field. 4. Click "Save". 5. Confirm the SSO User is shown in User Management.

b
The Cisco SNA appliance must be configured to enforce a minimum 15-character password length.
Medium - CCI-004066 - V-284887 - SV-284887r1212067_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000380
Vuln IDs
  • V-284887
Rule IDs
  • SV-284887r1212067_rule
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that must be tested before the password is compromised. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password.
Checks: C-89457r1212066_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy. Verify the "Password Minimum Character Length" is 15 or greater. If the Cisco SNA appliance is not configured to enforce a minimum 15-character password length for local accounts, this is a finding.

Fix: F-89362r1205428_fix

Configure the Cisco SNA appliance to enforce a minimum 15-character password length. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Password Minimum Character Length. Set to "15" or greater. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to enforce password complexity by requiring that at least one uppercase character be used.
Medium - CCI-004066 - V-284888 - SV-284888r1212069_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000390
Vuln IDs
  • V-284888
Rule IDs
  • SV-284888r1212069_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts, except for an account of last resort. Passwords should only be used when MFA using public key infrastructure (PKI) is not available, and for the account of last resort.
Checks: C-89458r1212068_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Number of Upper Case Letters in Password. Verify the number is one or greater. If the Cisco SNA appliance is not configured to require that at least one uppercase character be used in local account passwords, this is a finding.

Fix: F-89363r1205431_fix

Configure the Cisco SNA appliance to enforce password complexity by requiring at least one uppercase character be used. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Number of Upper Case Letters in Password. Set to "1" or greater. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to enforce password complexity by requiring that at least one lowercase character be used.
Medium - CCI-004066 - V-284889 - SV-284889r1212071_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000400
Vuln IDs
  • V-284889
Rule IDs
  • SV-284889r1212071_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort. Passwords should only be used when MFA using public key infrastructure (PKI) is not available, and for the account of last resort.
Checks: C-89459r1212070_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Number of Lower Case Letters in Password. Verify the number is "1" or greater. If the Cisco SNA appliance is not configured to require at least one lowercase character be used in local account passwords, this is a finding.

Fix: F-89364r1205434_fix

Configure the Cisco SNA appliance to enforce password complexity by requiring at least one lowercase character be used. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Number of Lower Case Letters in Password. Set to "1" or greater. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to enforce password complexity by requiring that at least one numeric character be used.
Medium - CCI-004066 - V-284890 - SV-284890r1212073_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000410
Vuln IDs
  • V-284890
Rule IDs
  • SV-284890r1212073_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort. Passwords should only be used when MFA using public key infrastructure (PKI) is not available, and for the account of last resort.
Checks: C-89460r1212072_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Numbers in Password. Verify the number is "1" or greater. If the Cisco SNA appliance is not configured to require that at least one numeric character be used in local account passwords, this is a finding.

Fix: F-89365r1205437_fix

Configure the Cisco SNA appliance to enforce password complexity by requiring at least one numeric character be used. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Numbers in Password. Set to "1" or greater. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to enforce password complexity by requiring that at least one special character be used.
Medium - CCI-004066 - V-284891 - SV-284891r1212075_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000420
Vuln IDs
  • V-284891
Rule IDs
  • SV-284891r1212075_rule
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort. Passwords should only be used when MFA using PKI is not available, and for the account of last resort.
Checks: C-89461r1212074_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Number of Symbols in Password. Verify the number is "1" or greater. If the Cisco SNA appliance is not configured to require that at least one special character be used in local account passwords, this is a finding.

Fix: F-89366r1205440_fix

Configure the Cisco SNA appliance to enforce password complexity by requiring at least one special character be used. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Minimum Numbers of Symbols in Password. Set to "1" or greater. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.
Medium - CCI-004066 - V-284892 - SV-284892r1212078_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
CSNA-ND-000430
Vuln IDs
  • V-284892
Rule IDs
  • SV-284892r1212078_rule
If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. In other words, characters may be the same within the two passwords; however, the positions of the like characters must be different. Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort. Passwords should only be used when MFA using PKI is not available, and for the account of last resort.
Checks: C-89462r1212076_chk

Review the Password Policy configuration of the Cisco SNA appliance. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Number of Characters Different From Previous Password. Verify the number is "8" or greater. If the Cisco SNA appliance does not require that when a local account password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.

Fix: F-89367r1212077_fix

Configure the Cisco SNA appliance to require that when a password is changed, the characters are changed in at least eight of the positions within the password. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy >> Number of Characters Different From Previous Password. Set to "8" or greater. Click "Apply Settings".

c
The Cisco SNA appliance must use FIPS 140-3-approved algorithms for authentication to a cryptographic module.
IA-7 - High - CCI-000803 - V-284896 - SV-284896r1227141_rule
RMF Control
IA-7
Severity
H
CCI
CCI-000803
Version
CSNA-ND-000490
Vuln IDs
  • V-284896
Rule IDs
  • SV-284896r1227141_rule
Unapproved mechanisms used for authentication to the cryptographic module are not validated and therefore, cannot be relied upon to provide confidentiality or integrity and DoW data may be compromised. Network devices using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DoW requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms. Satisfies: SRG-APP-000179-NDM-000265, SRG-APP-000411-NDM-000330, SRG-APP-000412-NDM-000331
Checks: C-89466r1212081_chk

Verify the Cisco SNA appliance is configured to use FIPS 140-3-approved algorithms for authentication to a cryptographic module by restricting encryption to Compliance Mode. Navigate to SNA Dashboard >> Configure >> Central Management >> (Appliance) Actions >> Edit Appliance Configuration >> General tab >> Compliance Mode. Verify "Enable FIPS Encryption Libraries" is checked at a minimum. If the Cisco SNA Appliance does not use FIPS-validated MAC to protect the integrity of nonlocal maintenance and diagnostic communications, this is a finding.

Fix: F-89371r1205455_fix

Configure the network device to use FIPS-validated MAC to protect the integrity of nonlocal maintenance and diagnostic communications. Navigate to SNA Dashboard >> Configure >> Central Management >> (Appliance) Actions >> Edit Appliance Configuration >> General tab >> Compliance Mode. Read the warnings and ensure all prerequisites are met. Then, check the boxes and type the requested number sequence to confirm. Select "Enable FIPS Encryption Libraries" and "Enable Common Criteria Encryption Libraries" for the most restrictive combination. Click "Apply Settings". Note: Review the Help Menu and configuration guides to ensure the configuration has met all prerequisites prior to enabling restricted libraries.

c
The Cisco SNA appliance must be configured to terminate sessions after five minutes of inactivity and set an absolute session timeout value of eight hours or less for admin sessions, except to fulfill documented and validated mission requirements.
SC-10 - High - CCI-001133 - V-284897 - SV-284897r1212085_rule
RMF Control
SC-10
Severity
H
CCI
CCI-001133
Version
CSNA-ND-000500
Vuln IDs
  • V-284897
Rule IDs
  • SV-284897r1212085_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the Cisco SNA appliance. Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, or de-allocating networking assignments at the application level if multiple application sessions are using a single, operating system-level network connection. This does not mean that the device terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.
Checks: C-89467r1212083_chk

Determine if the Cisco SNA appliance is configured to terminate the connection associated with a device management session after five minutes of inactivity. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Protected Sessions Time-Out >> Log Out User Due To Inactivity After this Many Minutes. Verify the number is "5" or fewer. If the Cisco SNA appliance does not terminate the connection associated with a device management session at the end of the session or after five minutes of inactivity, this is a finding. Verify the Cisco SNA appliance is configured to close admin sessions after eight hours or fewer. Navigate to Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Protected Sessions Time-Out >> Request User Re-authentication For Administrator-only Functions After This Many Minutes. Verify the number is "480" or less. If the Cisco SNA appliance is not configured to close admin sessions after eight hours or less, this is a finding.

Fix: F-89372r1212084_fix

Configure the Cisco SNA appliance to terminate the connection associated with a device management session after five minutes of inactivity. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Protected Sessions Time-Out >> Log Out User Due To Inactivity After this Many Minutes. Set to 5 or fewer. Click "Apply Settings". Configure the Cisco SNA appliance to close admin sessions after eight hours or less. Navigate to Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General>> Protected Sessions Time-Out >> Request User Re-authentication For Administrator-only Functions After This Many Minutes. Set to "480" or fewer. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to encrypt information at rest using a DoW-accepted algorithm to protect the confidentiality and integrity of the information.
SC-28 - Medium - CCI-001199 - V-284901 - SV-284901r1227145_rule
RMF Control
SC-28
Severity
M
CCI
CCI-001199
Version
CSNA-ND-000540
Vuln IDs
  • V-284901
Rule IDs
  • SV-284901r1227145_rule
Data at rest is inactive data stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest includes, but is not limited to, archived data, data that is not accessed or changed frequently, files stored on hard drives, USB thumb drives, files stored on backup tape and disks, and files stored off-site or on a storage area network. While data at rest can reside in many places, data at rest for a web server is data on the hosting system storage devices. Data stored as a backup on tape or stored off-site is no longer under the protection measures covered by the web server. There are several pieces of data the web server uses during operation. The web server must use an accepted encryption method, such as AES-256, to protect the confidentiality and integrity of the information.
Checks: C-89471r1227144_chk

Review the Cisco SNA appliance configuration to verify information at rest (i.e., backup configuration file) are encrypted. Navigate to SNA Dashboard >> Configure >> Central Management >> (Appliance) Actions >> Edit Appliance Configuration >> General tab >> Backup Configuration Encryption. Verify "Enable Encryption" is checked and "Password" has been set. Note: The encryption method is automatically set to AES256-GCM for this feature. If the information at rest (i.e., backup configuration file) is not encrypted using a DoW-accepted algorithm, this is a finding.

Fix: F-89376r1212090_fix

Configure the SNA appliance to encrypt information at rest by enabling the "Backup Configuration Encryption" feature. Navigate to SNA Dashboard >> Configure >> Central Management >> (Appliance) Actions >> Edit Appliance Configuration >> General tab >> Backup Configuration Encryption. Check "Enable Encryption" and enter a password in the "Password" boxes. Click "Apply Settings". Note: The encryption method is automatically set to AES256-GCM for this feature.

b
The Cisco SNA appliance must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts.
AU-5 - Medium - CCI-001858 - V-284910 - SV-284910r1212103_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001858
Version
CSNA-ND-000640
Vuln IDs
  • V-284910
Rule IDs
  • SV-284910r1212103_rule
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Satisfies: SRG-APP-000360-NDM-000295, SRG-APP-000795-NDM-000130
Checks: C-89480r1212101_chk

Determine if the Cisco SNA appliance is configured to generate an immediate alert of all audit failure events requiring real-time alerts. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> General Tab >> SMTP Configuration. Verify an SMTP server is configured (e.g., port, From Email, User Name, Password and Encryption Type). Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> General Tab >> DODIN Notifications. Verify "DODIN Notifications" is "Enabled" and sent to an appropriate email address. If an immediate alert of all audit failure events requiring real-time alerts is not generated, this is a finding.

Fix: F-89385r1212102_fix

Configure the Cisco SNA appliance to generate an immediate real-time alert of all audit failure events requiring real-time alerts. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> General Tab >> SMTP Configuration. Input the SMTP server settings (e.g., SMTP Server, Port, From Email, User Name, Password and Encryption Type). Select "Apply Settings". Note: The encryption type must be SMTPS or STARTTLS. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> General Tab >> DODIN Notifications. Click "Enable DODIN Notifications" and set the appropriate email address. Select "Apply Settings".

b
The Cisco SNA appliance must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
IA-3 - Medium - CCI-001967 - V-284916 - SV-284916r1212111_rule
RMF Control
IA-3
Severity
M
CCI
CCI-001967
Version
CSNA-ND-000700
Vuln IDs
  • V-284916
Rule IDs
  • SV-284916r1212111_rule
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network, internet). A remote connection is any connection with a device communicating through an external network (e.g., the internet). Because of the challenges of applying this requirement on a large scale, organizations are encouraged to only apply the requirement to those limited number (and type) of devices that truly need to support this capability.
Checks: C-89486r1212109_chk

Review the Cisco SNA appliance configuration to verify SNMP messages are authenticated using a FIPS-validated Keyed-HMAC. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Network Services. Verify "SNMP Agent" is "Enabled". Verify "SNMP Versions" is "3". Verify "Authentication Protocol" is set to "HMAC192_SHA256" or better. If the Cisco SNA appliance is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Fix: F-89391r1212110_fix

Configure the Cisco SNA appliance to authenticate SNMP messages using a FIPS-validated Keyed-HMAC. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Network Services. Set "SNMP Agent" to "Enabled". Set "SNMP Versions" to "3". Set "Authentication Protocol" to "HMAC192_SHA256" or better. Select "Apply Settings".

b
The Cisco SNA appliance must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
IA-3 - Medium - CCI-001967 - V-284917 - SV-284917r1212114_rule
RMF Control
IA-3
Severity
M
CCI
CCI-001967
Version
CSNA-ND-000710
Vuln IDs
  • V-284917
Rule IDs
  • SV-284917r1212114_rule
If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source. Satisfies: SRG-APP-000395-NDM-000347, SRG-APP-000925-NDM-000330
Checks: C-89487r1212112_chk

Review the Cisco SNA appliance configuration to determine if the network device authenticates NTP endpoints before establishing a local, remote, or network connection using authentication that is cryptographically based. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Network Services >> NTP Server. Verify a key symbol appears next to each NTP Server Entry. If the Cisco SNA appliance does not authenticate Network Time Protocol sources using authentication that is cryptographically based, this is a finding.

Fix: F-89392r1212113_fix

Configure the Cisco SNA appliance to authenticate NTP sources using authentication that is cryptographically based. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> Network Services >> NTP Server >> Actions >> Authenticate Connection. Enter a Key ID and Key Value. Apply Authentication.

b
The Cisco SNA appliance must install security-relevant firmware updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).
SI-2 - Medium - CCI-002605 - V-284919 - SV-284919r1212118_rule
RMF Control
SI-2
Severity
M
CCI
CCI-002605
Version
CSNA-ND-000770
Vuln IDs
  • V-284919
Rule IDs
  • SV-284919r1212118_rule
Security flaws with firmware are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant firmware updates. Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.
Checks: C-89489r1212116_chk

Verify software updates are consistently applied to the Cisco SNA appliance within 30 days unless the time period is directed by an authoritative source. Navigate to SNA Dashboard >> Configure >> Central Management >> Update Manager. View the "Installed Version" for each appliance. Compare each one to the authoritative source version. If the Cisco SNA appliance administrator does not install security-relevant updates within 30 days unless the time period is directed by an authoritative source, this is a finding.

Fix: F-89394r1212117_fix

Ensure patches are consistently applied to the Cisco SNA appliance within the time allowed. Navigate to SNA Dashboard >> Configure >> Central Management >> Update Manager >> Upload Update File (previously downloaded from Cisco Software Central) >> Select Appliance >> Actions... >> Install Update. Note: The SNA Manager should always be updated first to avoid versioning conflicts.

b
The Cisco SNA appliance must generate audit records for modifications of critical files on the system.
AU-12 - Medium - CCI-000172 - V-284924 - SV-284924r1212125_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000172
Version
CSNA-ND-000820
Vuln IDs
  • V-284924
Rule IDs
  • SV-284924r1212125_rule
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Cisco SNA Appliances provide Advanced Intrusion Detection Environment (AIDE) which is a host baselining system that detects modifications of critical files on a system. When it is enabled, AIDE runs an audit of the current system once a day. It compares the hash sum, permissions, and time accessed of each monitored file on the current file system against the values stored in the appliance database.
Checks: C-89494r1212123_chk

Verify the Cisco SNA appliance generates audit records for modification of critical system files. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Support >> Audit Logs. Verify AIDE logs are being produced. If the network device does not generate audit records for modification of critical system files, this is a finding.

Fix: F-89399r1212124_fix

Configure the Cisco SNA appliance to generate audit records for modification of critical system files. Navigate to SNA Dashboard >> Configure >> Central Management >> (Appliance) Actions >> Edit Appliance Configuration >> Appliance Tab. Enable AIDE checkbox. Click "Apply Settings".

b
The Cisco SNA appliance must be configured to use HTTP/2 at a minimum.
CM-6 - Medium - CCI-000366 - V-284928 - SV-284928r1212129_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
CSNA-ND-000870
Vuln IDs
  • V-284928
Rule IDs
  • SV-284928r1212129_rule
HTTP/2, like HTTPS, enhances security compared to HTTP/1.x by minimizing the risk of header-based attacks (e.g., header injection and manipulation). Websites that fully use HTTP/2 are inherently protected and defend against smuggling attacks. HTTP/2 provides the method for specifying the length of a request, which removes any potential for ambiguity that can be leveraged by an attacker. This is applicable to all web architectures such as load balancing/proxy use cases. - The front-end and back-end servers should both be configured to use HTTP/2. - HTTP/2 must be used for communications between web servers. - Browser vendors have agreed to only support HTTP/2 only in HTTPS mode; thus, TLS must be configured to meet this requirement. TLS configuration is out of scope for this requirement.
Checks: C-89498r1205550_chk

Verify HTTP/1.x downgrading is disabled. Navigate to Sysadmin Console >> Network >> HTTP Version >> Select >> Yes to Warning >> OK. If the message displayed states "There are no changes to HTTP/2 settings.", then HTTP/1.x has been disabled. If the HTTP/1.x downgrading is enabled, this is a finding.

Fix: F-89403r1205551_fix

Configure the Cisco SNA Appliance to use HTTP/2. Navigate to Sysadmin Console >> Network >> HTTP Version >> Select >> Yes to Warning >> OK.

c
The Cisco SNA appliance must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
CM-6 - High - CCI-000370 - V-284931 - SV-284931r1212136_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000370
Version
CSNA-ND-000900
Vuln IDs
  • V-284931
Rule IDs
  • SV-284931r1212136_rule
Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each network device. Satisfies: SRG-APP-000516-NDM-000336, SRG-APP-000175-NDM-000262, SRG-APP-000177-NDM-000263, SRG-APP-000400-NDM-000313
Checks: C-89500r1212134_chk

Review the Cisco SNA appliance configuration to verify the device is configured to use at least two authentication servers or a single sign-on (SSO) service as primary source for authentication. Navigate to SNA Dashboard >> Configure >> User Management >> Authentication and Authorization Tab >> Select a Service >> Actions... >> Edit. Observe whether multiple addresses have been configured. Note: It is expected that an SSO using SAML will employ redundant/load-balanced servers on the service side. There is no configuration for multiple SSO services. If the Cisco SNA appliance is not configured to use at least two authentication servers or an SSO service for the purpose of authenticating users prior to granting administrative access, this is a finding.

Fix: F-89405r1212135_fix

Configure the SNA appliance to use at least two authentication servers or an SSO service. TACACS+/RADIUS/LDAP Configuration: Navigate to SNA Dashboard >> Configure >> User Management >> Authentication and Authorization Tab >> Create (dropdown) >> Authentication Service. Select Type (e.g., TACACS+, RADIUS, LDAP). Input "Name" for service and "Add New" Server Information for each server of that service type. Save. Navigate to Create (dropdown) >> User. Input User Name, Authentication service (previously created), Role Settings. Save. Apply Configuration. OR SSO Configuration: A. Prepare for Configuration. 1. The following information is required to configure SSO: -The Identity Provider (IdP) URL must use the fully qualified domain name or IPv4 address. - If the IdP URL starts with HTTPS, download the certificate authority (CA) certificate. 2. Certificate Requirements: If the URL for downloading the IDP URL starts with HTTPS, confirm the certificate is added to the appliance Trust Stores. B. Configure the Service Provider. 1. Navigate to the management console webpage (SMC). 2. Log in as an admin with sufficient privileges. 3. Select Configure >> User Management. 4. Select Create (Dropdown) >> Authentication Service >> SSO. 5. Select IdP Type (Dropdown) >> Microsoft ADFS. 6. Enter the URL to download the IdP's configuration file. Requirements: Enter the fully qualified domain name or IP address. Alternatively, upload an Identity Provider Metadata XML File. 7. Select "Disable Requested Authentication Context". 8. Select Name Identifier Format >> Transient (if following schema note below). Otherwise configure according to local format. 9. Add a Login Screen Label relevant to local configurations. 10. Select "Save". 11. When redirected to the Authentication and Authorization tab, it may take up to five minutes to apply changes and SSO Status to become "Ready". 12. Select Actions >> Enable SSO. C. Configure ADFS according to local procedure to add the Relying Party Trust. Note: For ADFS configuration, create and modify the following Claim Issuance Policy Custom Rule: c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = "http://YOURADFSFQDN./adfs/com/adfs/service/trust", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "https://YOURSNAFQDN/fedlet"); D. Add an SSO User. 1. Log in to the SMC Web UI. 2. Select Configure >> User Management >> Users >> Create User. 3. Complete the fields to create a new user. -Authentication Service: Select SSO. - User Name: Enter the first part of the email address for the IdP account. Ensure the ID is identical to the one that will be used for SSO at login. For example, for name@email.com, enter name in this field. 4. Click "Save". 5. Confirm the SSO User is shown in User Management.

b
The Cisco SNA appliance must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider.
CM-6 - Medium - CCI-000366 - V-284934 - SV-284934r1227151_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
CSNA-ND-000930
Vuln IDs
  • V-284934
Rule IDs
  • SV-284934r1227151_rule
For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority (CA) will suffice.
Checks: C-89503r1227149_chk

Determine if the Cisco SNA appliance obtains public key certificates from an appropriate certificate policy through an approved service provider. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Configuration >> Appliance Tab >> SSL/TLS Appliance Identity. Review the TLS certificate to determine if it is issued by a DoW CA. If the Cisco SNA appliance does not obtain its public key certificates from an appropriate certificate policy through an approved service provider, this is a finding.

Fix: F-89408r1227150_fix

Configure the network device to obtain its public key certificates from an appropriate certificate policy through an approved service provider. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Edit Configuration >> Appliance Tab >> SSL/TLS Appliance Identity >> Update Identity >> Generate CSR. Input RSA Key Length. Download CSR >> Submit CSR to DoW CA >> Click Replace Identity >> Apply Settings. For further details review the SNA SSL/TLS Certificates Guide: https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/certificates/7_5_3_SSL_TLS_Certificates_for_Managed_Appliances_Guide_DV_1_0.pdf.

c
The Cisco SNA appliance must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required.
AU-4 - High - CCI-001851 - V-284935 - SV-284935r1212214_rule
RMF Control
AU-4
Severity
H
CCI
CCI-001851
Version
CSNA-ND-000940
Vuln IDs
  • V-284935
Rule IDs
  • SV-284935r1212214_rule
The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can be used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, is important for showing whether someone is an internal employee or an outside threat. Satisfies: SRG-APP-000516-NDM-000350, SRG-APP-000515-NDM-000325
Checks: C-89504r1212142_chk

Verify the Cisco SNA appliance is configured to send log data to at least one central log server. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> Network Services tab >> Audit Log Destination (Syslog over TLS). Verify one syslog server is configured. If the Cisco SNA appliance is not configured to send log data to at least one central log server, this is a finding.

Fix: F-89409r1212143_fix

Configure the Cisco SNA appliance to send log data to at least one central log server. Repeat these steps for each Syslog Server needed. Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> Network Services tab >> Audit Log Destination (Syslog over TLS) >> Add New. Input a Server Name or IP Address, Destination Port, and Certificate Revocation Mode. Apply Settings.

c
The Cisco SNA appliance must be running an operating system release that is currently supported by the vendor.
CM-6 - High - CCI-000366 - V-284936 - SV-284936r1212147_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
CSNA-ND-000950
Vuln IDs
  • V-284936
Rule IDs
  • SV-284936r1212147_rule
Cisco SNA appliances running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities. Satisfies: SRG-APP-000516-NDM-000351, SRG-APP-001035-NDM-000340
Checks: C-89505r1212145_chk

Verify the Cisco SNA appliance is running an operating system release that is currently supported by the vendor. SNA Dashboard >> Configure >> Central Management >> Update Manager. View the "Installed Version" for each appliance. Compare to the supported versions on the vendor website. If the Cisco SNA appliance is not a version supported by the vendor, this is a finding.

Fix: F-89410r1212146_fix

Upgrade the Cisco SNA appliance to an operating system that is supported by the vendor. Navigate to SNA Dashboard >> Configure >> Central Management >> Update Manager >> Upload Update File (previously downloaded from Cisco Software Central) >> Select Appliance >> Actions... >> Install Update.

b
The Cisco SNA appliance must be configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.
Medium - CCI-004046 - V-284937 - SV-284937r1212207_rule
RMF Control
Severity
M
CCI
CCI-004046
Version
CSNA-ND-000970
Vuln IDs
  • V-284937
Rule IDs
  • SV-284937r1212207_rule
The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multifactor authentication (MFA) is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process. Satisfies: SRG-APP-000820-NDM-000170, SRG-APP-000825-NDM-000180
Checks: C-89506r1212206_chk

Verify the network device is configured to implement MFA for local, network, and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. Navigate to the login page, then select Single Sign-on (SSO). At the SAML IdP login page, enter a certificate and pin (as managed by middleware such as ActivClient) when prompted. Note: The MFA requirement is met by the SSO server and will require coordination with that server's administrator. If the Cisco SNA appliance is not configured to implement multifactor authentication for local, network, and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix: F-89411r1212149_fix

Configure the Cisco SNA appliance to implement multifactor authentication for local, network, and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. A. Prepare for Configuration. 1. The following information is required to configure SSO: -The Identity Provider (IdP) URL must use the fully qualified domain name or IPv4 address. - If the IdP URL starts with HTTPS, download the certificate authority (CA) certificate. 2. Certificate Requirements: If the URL for downloading the IDP URL starts with HTTPS, confirm the certificate is added to the appliance Trust Stores. B. Configure the Service Provider. 1. Navigate to the SMC. 2. Log in as an admin with sufficient privileges. 3. Select Configure >> User Management. 4. Select Create (Dropdown) >> Authentication Service >> SSO. 5. Select IdentityProvider (IdP) Type (Dropdown) >> Microsoft ADFS. 6. Enter the URL where the Identity Provider's configuration file can be downloaded. Requirements: Enter the fully qualified domain name or IP address. Alternatively, upload an Identity Provider Metadata XML File. 7. Select "Disable Requested Authentication Context". 8. Select Name Identifier Format >> Transient (if following schema note below). Otherwise, configure according to local format. 9. Add a Login Screen Label relevant to local configurations. 10. Select "Save". 11. When redirected to the Authentication and Authorization tab, it may take up to five minutes to apply changes and SSO Status to become "Ready". 12. Select Actions >> Enable SSO. C. Configure ADFS according to local procedure to add the Relying Party Trust. Note: For ADFS configuration, create and modify the following Claim Issuance Policy Custom Rule: c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = "http://YOURADFSFQDN./adfs/com/adfs/service/trust", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "https://YOURSNAFQDN/fedlet"); D. Add an SSO User. 1. Log in to the SMC Web UI. 2. Select Configure >> User Management >> Users >> Create User. 3. Complete the fields to create a new user. For compliance, configure the user as follows: Authentication Service: Select SSO. User Name: Enter the first part of the email address for the IdP account. Make sure the ID is identical to the one that will be used for SSO at login. For example, for name@email.com, enter "name" in this field. 4. Click "Save". 5. Confirm the SSO User is shown in User Management.

b
The Cisco SNA appliance must be configured to allow user selection of long passwords and passphrases, including spaces and all printable characters for password-based authentication.
Medium - CCI-004064 - V-284939 - SV-284939r1212154_rule
RMF Control
Severity
M
CCI
CCI-004064
Version
CSNA-ND-001000
Vuln IDs
  • V-284939
Rule IDs
  • SV-284939r1212154_rule
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.
Checks: C-89508r1212152_chk

Verify the Cisco SNA appliance is configured to allow user selection of long passwords and passphrases, including spaces and all printable characters. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy. Verify the "Maximum Number of Characters in Password" is greater than or equal to "32" (up to 256). Verify the "Minimum Number of Characters in Password" is greater than or equal to "15". If the Cisco SNA appliance is not configured to allow user selection of long passwords and passphrases, including spaces and all printable characters, this is a finding.

Fix: F-89413r1212153_fix

Configure the Cisco SNA appliance to allow user selection of long passwords and passphrases, including spaces and all printable characters. Navigate to SNA Dashboard >> Central Management >> Inventory >> Actions... >> Edit Appliance Configuration >> General >> Password Policy. Verify the "Maximum Number of Characters in Password" is greater than or equal to "32" (up to 256). Verify the "Minimum Number of Characters in Password" is greater than or equal to "15". Apply Settings.

b
The Cisco SNA appliance must be configured to implement certificate revocation checking to support path discovery and validation for public key-based authentication.
Medium - CCI-004068 - V-284940 - SV-284940r1212209_rule
RMF Control
Severity
M
CCI
CCI-004068
Version
CSNA-ND-001010
Vuln IDs
  • V-284940
Rule IDs
  • SV-284940r1212209_rule
Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses like OCSP. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.
Checks: C-89509r1212155_chk

Verify the Cisco SNA appliance is configured to implement certificate revocation checking to support path discovery and validation. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Network Services >> Audit Log Destination (Syslog Over TLS). Verify "Certificate Revocation" set to "Hard Fail" for servers. Note that other forms of public key authentication (inter-device HTTPS, SAML, etc.) automatically perform certificate checking without additional configuration. If the Cisco SNA appliance is not configured to implement certificate revocation checking to support path discovery and validation, this is a finding.

Fix: F-89414r1212208_fix

Configure the Cisco SNA appliance to implement certificate revocation checking to support path discovery and validation using certificate revocation lists (CRLs), or Online Certificate Status Protocol (OCSP). Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> Network Services >> Audit Log Destination (Syslog Over TLS) >> Actions... >> Edit. Select "Hard Fail" for "Certificate Revocation". Note: Other forms of public key authentication (inter-device HTTPS, SAML, etc.) automatically perform certificate checking without additional configuration.

b
The Cisco SNA appliance must be configured to include only approved trust anchors in trust stores or certificate stores managed by the organization.
Medium - CCI-004909 - V-284942 - SV-284942r1212160_rule
RMF Control
Severity
M
CCI
CCI-004909
Version
CSNA-ND-001030
Vuln IDs
  • V-284942
Rule IDs
  • SV-284942r1212160_rule
Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
Checks: C-89511r1212159_chk

Verify the Cisco SNA appliance is configured to include only approved trust anchors in trust stores or certificate stores managed by the organization. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> General >> Trust Store. Verify only approved certificates and Certificate Authorities (CAs) are present. If the Cisco SNA appliance is not configured to include only approved trust anchors in trust stores or certificate stores managed by the organization, this is a finding.

Fix: F-89416r1205591_fix

Configure the network device to include only approved trust anchors in trust stores or certificate stores managed by the organization. Navigate to SNA Dashboard >> Configure >> Central Management >> Inventory >> Actions... >> General >> Trust Store. Delete any untrusted certificates. Note: Ensure all appliance certificates had their self-signed certificates replaced and are trusted in each other's store.