STIGQter: STIG Summary: Symantec ProxySG NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jan 2020:

Symantec ProxySG must not have a default manufacturer passwords when deployed.

DISA Rule

SV-104535r1_rule

Vulnerability Number

V-94705

Group Title

SRG-APP-000080-NDM-000345

Rule Version

SYMP-NM-000270

Severity

CAT II

CCI(s)

• CCI-002041 - The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.

Weight

10

Fix Recommendation

Passwords are set during initial configuration of the Symantec ProxySG. In order to perform this action on a new appliance:

1. Connect to the Symantec ProxySG via a serial console, choose "Manual Setup", and follow the prompts to set system parameters, including local account passwords.
2. Once the system has been configured, local passwords can be changed from the Web Management Console, click Configuration >> Authentication >> Console Access >> Change Password.

Check Contents

Verify the initial configuration has been set. Attempt to logon to an SSH session using the default user name of "Admin". Verify that there is a prompt for a password.

If Symantec ProxySG does not prompt for a password when logon is attempted, this is a finding.

Vulnerability Number

V-94705

Documentable

False

Rule Version

SYMP-NM-000270

Severity Override Guidance

Verify the initial configuration has been set. Attempt to logon to an SSH session using the default user name of "Admin". Verify that there is a prompt for a password.

If Symantec ProxySG does not prompt for a password when logon is attempted, this is a finding.

Check Content Reference

M

Target Key

3517

Comments