HPE Nimble Storage Array Security Technical Implementation Guide

Description

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]

Details

Version / Release: V1R1

Published: 2022-03-16

Updated At: 2022-04-06 01:05:34

Actions

Download

Filter

Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-252186r814038_rule HPEN-NM-000010 CCI-000057 MEDIUM The HPE Nimble must initiate a session lock after a 15-minute period of inactivity. A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Rather than relying on the user to manually lock their management session prior to vacating
    SV-252187r814041_rule HPEN-NM-000020 CCI-000044 MEDIUM The HPE Nimble must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.
    SV-252188r814044_rule HPEN-NM-000030 CCI-000048 MEDIUM The HPE Nimble must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. Display of the DoD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, a
    SV-252189r814047_rule HPEN-NM-000040 CCI-002041 MEDIUM The HPE Nimble must not have any default manufacturer passwords when deployed. Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password and gain access to the device, which can result in loss of availability, confidentiality, or integrity of network traffic. Many default v
    SV-252190r814050_rule HPEN-NM-000050 CCI-000205 MEDIUM The HPE Nimble must enforce a minimum 15-character password length. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a passwor
    SV-252191r814053_rule HPEN-NM-000060 CCI-000192 MEDIUM The HPE Nimble must enforce password complexity by requiring that at least one upper-case character be used. Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password
    SV-252192r814056_rule HPEN-NM-000070 CCI-000193 MEDIUM The HPE Nimble must enforce password complexity by requiring that at least one lower-case character be used. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password
    SV-252193r814059_rule HPEN-NM-000080 CCI-000194 MEDIUM The HPE Nimble must enforce password complexity by requiring that at least one numeric character be used. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password
    SV-252194r814062_rule HPEN-NM-000090 CCI-001619 MEDIUM The HPE Nimble must enforce password complexity by requiring that at least one special character be used. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password
    SV-252195r814065_rule HPEN-NM-000100 CCI-000195 MEDIUM The HPE Nimble must require that when a password is changed, the characters are changed in at least eight of the positions within the password. If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks. The number of changed c
    SV-252196r814068_rule HPEN-NM-000110 CCI-001133 HIGH The HPE Nimble must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminat
    SV-252197r814071_rule HPEN-NM-000120 CCI-000366 HIGH The HPE Nimble must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access. Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrat
    SV-252198r814074_rule HPEN-NM-000130 CCI-000366 MEDIUM The HPE Nimble must obtain its public key certificates from an appropriate certificate policy through an approved service provider. For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Aut
    SV-252199r814077_rule HPEN-NM-000140 CCI-002605 HIGH The HPE Nimble must forward critical alerts (at a minimum) to the system administrators and the ISSO. Alerts are essential to let the system administrators and security personnel know immediately of issues which may impact the system or users. If these alerts are also sent to the syslog, this information is used to detect weaknesses in security that enabl
    SV-252200r822498_rule HPEN-NM-000150 CCI-000366 HIGH The HPE Nimble must be running an operating system release that is currently supported by the vendor. Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities.
    SV-252201r814083_rule HPEN-NM-000160 CCI-000054 MEDIUM The HPE Nimble must limit the number of concurrent sessions to an organization-defined number for each administrator account. Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpfu
    SV-252202r814094_rule HPEN-NM-000271 CCI-000366 MEDIUM The HPE Nimble must be configured to synchronize internal information system clocks using an authoritative time source. The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. Multiple time sources provide redundancy by i
    SV-252203r814089_rule HPEN-NM-000300 CCI-001851 MEDIUM The HPE Nimble must configure a syslog server onto a different system or media than the system being audited. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. UDP is used to communicate between the array group and the syslog server (SSL is not supported at this time). This is an issue because DoD requires the u
    SV-252902r822432_rule HPEN-NM-000221 CCI-000382 MEDIUM HPE Nimble must be configured to disable HPE InfoSight. DoD requires that the Mission Owner uses only the cloud services offering listed in either the FedRAMP or DISA PA DoD Cloud Catalog to host Unclassified, public-releasable, DoD information. HPE InfoSight data collection is disabled by default in the HPE