DISA STIG library Y26M04
| Ref | Title | Text | |
|---|---|---|---|
| CISC-ND-000010 | The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number. | Note: This requirement is not applicable to file transfer actions such as FTP, SCP, and SFTP. Review the router configuration to determine if concurrent management sessions are limited as shown in the example below: ip http secure-server ip | |
| CISC-ND-000090 | The Cisco router must be configured to automatically audit account creation. | Review the router configuration to determine if it automatically audits account creation. The configuration should look similar to the example below: archive log config logging enable Note: Configuration changes can be viewed using the show | |
| CISC-ND-000100 | The Cisco router must be configured to automatically audit account modification. | Review the router configuration to determine if it automatically audits account modification. The configuration should look similar to the example below: archive log config logging enable Note: Configuration changes can be viewed using the | |
| CISC-ND-000110 | The Cisco router must be configured to automatically audit account disabling actions. | Review the router configuration to determine if it automatically audits account disabling. The configuration should look similar to the example below: archive log config logging enable Note: Configuration changes can be viewed using the sho | |
| CISC-ND-000120 | The Cisco router must be configured to automatically audit account removal actions. | Review the router configuration to determine if it automatically audits account removal. The configuration should look similar to the example below: archive log config logging enable Note: Configuration changes can be viewed using the show | |
| CISC-ND-000140 | The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies. | Review the Cisco router configuration to verify that it is compliant with this requirement. Step 1: Verify that the line vty has an ACL inbound applied as shown in the example below. line vty 0 1 access-class MANAGEMENT_NET in transport inp | |
| CISC-ND-000150 | The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes. | Review the Cisco router configuration to verify that it enforces the limit of three consecutive invalid logon attempts as shown in the example below. login block-for 900 attempts 3 within 120 Note: The configuration example above will block | |
| CISC-ND-000160 | The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. banner login ^C You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized | |
| CISC-ND-000210 | The Cisco device must be configured to audit all administrator activity. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. hostname R1 ! logging userinfo ! … … … archive log config logging enable ! Note: The logging userinfo global configura | |
| CISC-ND-000280 | The Cisco router must produce audit records containing information to establish when (date and time) the events occurred. | Verify that the router is configured to include the date and time on all log records as shown in the configuration example below. service timestamps log datetime localtime If time stamps are not configured, this is a finding. | |
| CISC-ND-000290 | The Cisco router must produce audit records containing information to establish where the events occurred. | Review the deny statements in all interface ACLs to determine if the log-input parameter has been configured as shown in the example below. Note: log-input can only apply to interface bound ACLs. ip access-list extended BLOCK_INBOUND deny i | |
| CISC-ND-000330 | The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands. | Review the Cisco router configuration to verify that it is compliant with this requirement. The configuration example below will log all configuration changes. archive log config logging enable Note: Configuration changes can be viewed usin | |
| CISC-ND-000380 | The Cisco router must be configured to protect audit information from unauthorized modification. | Review the Cisco router configuration to verify that it is compliant with this requirement. Step 1: If persistent logging is enabled as shown in the example below, go to step 2. Otherwise, this requirement is not applicable. logging persist | |
| CISC-ND-000390 | The Cisco router must be configured to protect audit information from unauthorized deletion. | Review the Cisco router configuration to verify that it is compliant with this requirement. Step 1: If persistent logging is enabled as shown in the example below, go to step 2. Otherwise, this requirement is not applicable. logging persist | |
| CISC-ND-000460 | The Cisco router must be configured to limit privileges to change the software resident within software libraries. | Verify that the router is not configured with a privilege level other than "15" to allow access to the file system as shown in the example below. file privilege 10 Note: The default privilege level required for access to the file system is | |
| CISC-ND-000470 | The Cisco router must be configured to prohibit the use of all unnecessary and nonsecure functions and services. | Verify that the router does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration: boot network ip boot server ip bootp server ip dns server ip i | |
| CISC-ND-000490 | The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. | Step 1: Review the Cisco router configuration to verify that a local account for last resort has been configured. username xxxxxxxxxxx privilege nn common-criteria-policy PASSWORD_POLICY password xxxxxxxxxx Note: The configured Common Crite | |
| CISC-ND-000550 | The Cisco router must be configured to enforce a minimum 15-character password length. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY min-length 15 If the Cisco router is not configured to en | |
| CISC-ND-000570 | The Cisco router must be configured to enforce password complexity by requiring that at least one uppercase character be used. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY upper-case 1 If the Cisco router is not configured to enf | |
| CISC-ND-000580 | The Cisco router must be configured to enforce password complexity by requiring that at least one lowercase character be used. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY lower-case 1 If the Cisco router is not configured to enf | |
| CISC-ND-000590 | The Cisco router must be configured to enforce password complexity by requiring that at least one numeric character be used. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY numeric-count 1 If the Cisco router is not configured to | |
| CISC-ND-000600 | The Cisco router must be configured to enforce password complexity by requiring that at least one special character be used. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY special-case 1 If the Cisco router is not configured to e | |
| CISC-ND-000610 | The Cisco router must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. aaa new-model ! ! aaa common-criteria policy PASSWORD_POLICY char-changes 8 If the Cisco router is not configured to r | |
| CISC-ND-000620 | The Cisco router must only store cryptographic representations of passwords. | Review the router configuration to determine if passwords are encrypted as shown in the example below. service password-encryption If the router is not configured to encrypt passwords, this is a finding. | |
| CISC-ND-000720 | The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity. | Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to five minutes or less as shown in the following example: ip http secure-server ip http timeout | |
| CISC-ND-000880 | The Cisco router must be configured to automatically audit account enabling actions. | Review the router configuration to determine if it automatically audits account enabling. The configuration should look similar to the example below: archive log config logging enable Note: Configuration changes can be viewed using the show | |
| CISC-ND-000980 | The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. | Verify that the Cisco router is configured with a logging buffer size. The configuration should look like the example below: logging buffered xxxxxxxx informational If a logging buffer size is not configured, this is a finding. If the Cisco | |
| CISC-ND-001000 | The Cisco router must be configured to generate an alert for all audit failure events. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. logging trap critical Note: The parameter "critical" can replaced with a lesser severity level (i.e. error, warning, n | |
| CISC-ND-001030 | The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the configuration example below. ntp server x.x.x.x ntp server y.y.y.y If the Cisco router is not configured to synchronize its clock wit | |
| CISC-ND-001130 | The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. snmp-server group V3GROUP v3 auth read V3READ write V3WRITE snmp-server host x.x.x.x version 3 auth V3USER Authenticat | |
| CISC-ND-001140 | The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. snmp-server group V3GROUP v3 priv read V3READ write V3WRITE snmp-server view V3READ iso included snmp-server view V3WR | |
| CISC-ND-001150 | The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the configuration example below. ntp authentication-key 1 hmac-sha2-256 xxxxxx ntp authenticate ntp trusted-key 1 ntp server x.x.x.x key | |
| CISC-ND-001200 | The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. NOTE: Although allowed by SP800-131Ar2 for some applications, SHA-1 is considered a compromised hashing standard and i | |
| CISC-ND-001210 | The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions. | Review the Cisco router configuration to verify that it is compliant with this requirement. SSH Example ip ssh version 2 ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr If the router is not configured to implement crypto | |
| CISC-ND-001250 | The Cisco router must be configured to generate log records when administrator privileges are deleted. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. archive log config logging enable If the Cisco router is not configured to generate log records when administrator pri | |
| CISC-ND-001260 | The Cisco router must be configured to generate audit records when successful/unsuccessful logon attempts occur. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the examples below. login on-failure log login on-success log If the Cisco router is not configured to generate audit records when succes | |
| CISC-ND-001270 | The Cisco router must be configured to generate log records for privileged activities. | Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example configurations below. archive log config logging enable If the Cisco router is not configured to generate log records for pri | |
| CISC-ND-001370 | The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access. | Review the Cisco router configuration to verify the device is configured to use at least two authentication servers as primary source for authentication as shown in the following example: aaa new-model ! aaa authentication CONSOLE group rad | |
| CISC-ND-001410 | The Cisco router must be configured to back up the configuration when changes occur. | Review the Cisco router configuration to verify that it is compliant with this requirement. The example configuration below will send the configuration to a SCP server when a configuration change occurs. event manager applet BACKUP_CONFIG e | |
| CISC-ND-001440 | The Cisco router must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider. | Review the router configuration to determine if a CA trust point has been configured. The CA trust point will contain the URL of the CA in which the router has enrolled with. Verify this is a DOD or DOD-approved CA. This will ensure the rou | |
| CISC-ND-001450 | The Cisco router must be configured to send log data to at least two syslog servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). | Verify that the router is configured to send logs to at least two syslog servers. The configuration should look similar to the example below: logging x.x.x.x logging x.x.x.x If the router is not configured to send log data to the syslog ser | |
| CISC-ND-001470 | The Cisco router must be running an IOS release that is currently supported by Cisco Systems. | Verify that the router is in compliance with this requirement by having the router administrator enter the following command: show version Verify that the release is still supported by Cisco. All releases supported by Cisco can be found on |
42 of 42.