The VMM must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-207480
SRG-OS-000375-VMM-001510
SV-207480r984255_rule
Medium
Description
Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device.
Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DOD common access card.
A privileged account is defined as a VMM account with authorizations of a privileged user.
Remote access is access to DOD nonpublic VMMs by an authorized user (or a VMM) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Verify the VMM implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
If it does not, this is a finding.
Fix Text (F-7737r365845_fix)
Configure the VMM to implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.