HYCU for Nutanix Security Technical Implementation Guide

Version: 1

Updated: 10 Sep 2021

Findings: 41

Findings

V-246819 - The HYCU 4.1 application and server must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type. (medium)
V-246820 - The HYCU 4.1 application and server must initiate a session lock after a 15-minute period of inactivity. (medium)
V-246821 - The HYCU server must terminate shared/group account credentials when members leave the group. (medium)
V-246822 - The HYCU 4.1 Application must enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device. (high)
V-246823 - If the HYCU Server or Web UI uses discretionary access control, the network device must enforce organization-defined discretionary access control policies over defined subjects and objects. (medium)
V-246824 - The HYCU virtual machine must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies. (medium)
V-246825 - The HYCU server and Web UI must audit the execution of privileged functions. (medium)
V-246826 - The HYCU VM console must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any logon attempt for 15 minutes. (medium)
V-246827 - The HYCU VM console must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. (medium)
V-246828 - The HYCU VM console must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access. (medium)
V-246829 - The HYCU VM/server must be configured to disable SSH. (medium)
V-246830 - The HYCU VM console and HYCU Web UI must be configured to use an authentication server for authenticating users prior to granting access to protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined requirements. (high)
V-246831 - The HYCU server must generate audit records when successful/unsuccessful attempts to access privileges occur. (medium)
V-246832 - The HYCU server must generate audit records when successful/unsuccessful attempts to modify or delete administrator privileges occur. (medium)
V-246833 - The HYCU server must generate audit records when successful/unsuccessful logon attempts occur. (medium)
V-246834 - The HYCU server must generate audit records for privileged activities or other system-level access. (medium)
V-246835 - The HYCU server must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event. (medium)
V-246836 - The HYCU server must generate audit records containing information that establishes the identity of any individual or process associated with the event. (medium)
V-246837 - The HYCU Server must generate audit records containing the full-text recording of privileged commands. (medium)
V-246838 - The HYCU server must initiate session auditing upon startup and produce audit log records containing sufficient information to establish what type of event occurred. (medium)
V-246839 - The HYCU server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. (medium)
V-246840 - The HYCU server must be configured to conduct backups of system-level information when changes occur and to offload audit records onto a different system or media. (medium)
V-246841 - The HYCU Web UI must generate an immediate real-time alert of all audit failure events requiring real-time alerts. (medium)
V-246842 - The HYCU server must be configured to synchronize internal information system clocks using redundant authoritative time sources. (medium)
V-246843 - The HYCU server must protect audit information from unauthorized deletion. (medium)
V-246844 - The HYCU server must protect audit tools from unauthorized access, modification, and deletion. (medium)
V-246845 - The HYCU appliance must be running a release that is currently supported by the vendor. (high)
V-246846 - The HYCU server must back up audit records at least every seven days onto a different system or system component than the system or component being audited. (medium)
V-246847 - The HYCU server must obtain its public key certificates from an appropriate certificate policy through an approved service provider. (medium)
V-246848 - The network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. (high)
V-246849 - The network device must implement replay-resistant authentication mechanisms for network access to privileged accounts. (medium)
V-246850 - The HYCU server must authenticate Network Time Protocol sources using authentication that is cryptographically based. (medium)
V-246851 - The HYCU server must enforce password complexity by requiring that at least one uppercase character be used. (medium)
V-246852 - The network device must enforce a minimum 15-character password length. (medium)
V-246853 - The HYCU server must require that when a password is changed, the characters are changed in at least eight of the positions within the password. (medium)
V-246854 - The HYCU VM console must not have any default manufacturer passwords when deployed. (medium)
V-246855 - The HYCU server must prohibit the use of cached authenticators after an organization-defined time period. (medium)
V-246856 - The HYCU server must use FIPS-validated algorithms for authentication to a cryptographic module and Keyed-Hash Message Authentication Code (HMAC) to protect the integrity and confidentiality of remote maintenance sessions. (high)
V-246857 - The HYCU server and Web UI must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 15 minutes of inactivity except to fulfill documented and validated mission requirements. (high)
V-246858 - The network device must generate unique session identifiers using a FIPS 140-2 approved random number generator. (medium)
V-246859 - The HYCU Web UI must be configured to send log data to a central log server for forwarding alerts to the administrators and the ISSO. (high)