PaM Password <Role|device> enforces the use of strong user SG.AC-21 FR20, FC12, Management passwords, in accordance with FIPS 112, and FS3 protects user passwords from potential exposure. This includes: 1. Ensuring that passwords cross component boundaries in the clear. 2. Ensuring that passwords are never stored in the clear and that stored password hashes use a cryptographic hash function in accordance with FIPS 180-2. 3. Ensuring that passwords are never included in or allowed to be embedded into tools, source code, scripts, URLs, aliases, or shortcuts. 4. Enforcing password complexity policies (minimum length of at least 10 characters with a combination of lower/upper case, numerals, and special characters). 5. Changing passwords at defined intervals and minimizing reuse. 6. Expiring passwords after defined intervals of inactivity. 7. Protecting the password store from unauthorized modification. PC Processor The <Role's host> shall implement process SG.SC-6 FR28 Consumption monitoring and control mechanisms to identify and mitigate processor consumption (e.g., runaway or starved processes) that inhibits the function of any <Role> resident on <Role's host> PDA Portable Device The system limits attachment of portable SG.AC-17, FR6, FC12 Attachment devices and media to allow only specifically SG.SC-4, authorized users to do so. The default state SG.MP-3 shall disable all access from portable devices and media. Attachment of portable devices and media shall be enabled only where it is necessary for operation and/or maintenance functions. The system prevents the automated execution of code located on portable media. Mobile devices traveling to high risk locations shall be appropriately labeled, hardened, and subsequently sanitized upon return; i.e., such mobile devices shall contain only minimal information required to conduct business during the use period. PFP Protection Function Individual <Protection Applications> shall SG.SC-22 FZ2, FZ4 Preservation continue to provide functions designated by the organization as essential to operations in the face of the loss or compromise of any single device, communications link, or message in the overarching protection scheme.
PaM Password Management <Role|device> enforces the use of strong user passwords, in accordance with FIPS 112, and protects user passwords from potential exposure. This includes: 1. Ensuring that passwords cross component boundaries in the clear. 2. Ensuring that passwords are never stored in the clear and that stored password hashes use a cryptographic hash function in accordance with FIPS 180-2. 3. Ensuring that passwords are never included in or allowed to be embedded into tools, source code, scripts, URLs, aliases, or shortcuts. 4. Enforcing password complexity policies (minimum length of at least 10 characters with a combination of lower/upper case, numerals, and special characters). 5. Changing passwords at defined intervals and minimizing reuse. 6. Expiring passwords after defined intervals of inactivity. 7. Protecting the password store from unauthorized modification. SG.AC-21 FR20, FC12, FS3 PC Processor Consumption The <Role's host> shall implement process monitoring and control mechanisms to identify and mitigate processor consumption (e.g., runaway or starved processes) that inhibits the function of any <Role> resident on <Role's host> SG.SC-6 FR28 PDA Portable Device Attachment The system limits attachment of portable devices and media to allow only specifically authorized users to do so. The default state shall disable all access from portable devices and media. Attachment of portable devices and media shall be enabled only where it is necessary for operation and/or maintenance functions. The system prevents the automated execution of code located on portable media. Mobile devices traveling to high risk locations shall be appropriately labeled, hardened, and subsequently sanitized upon return; i.e., such mobile devices shall contain only minimal information required to conduct business during the use period. SG.AC-17, SG.SC-4, SG.MP-3 FR6, FC12 PFP Protection Function Preservation Individual <Protection Applications> shall continue to provide functions designated by the organization as essential to operations in the face of the loss or compromise of any single device, communications link, or message in the overarching protection scheme. SG.SC-22 FZ2, FZ4
SA%20Security%20Profile%20-%20v0_15%20-%2020120930.docx