The HYCU virtual appliance must enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-268222	SRG-APP-000033-NDM-000212	HYCU-ND-000040	SV-268222r1038366_rule	2024-10-29	1

Description
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement.

Description

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement.

ℹ️ Check
Review the Self-Service menu within HYCU to view accounts and user roles (Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer). User roles have a predefined and nonchangeable set of user privileges. To check exact set of privileges of each user, navigate to Self-Service context in the HYCU UI. Click on the question mark in the upper-right corner, followed by "Help with This Page". Scroll down to the "User Roles" section. If users can perform more functions than those specified for their role, this is a finding.

ℹ️ Check

Review the Self-Service menu within HYCU to view accounts and user roles (Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer). User roles have a predefined and nonchangeable set of user privileges. To check exact set of privileges of each user, navigate to Self-Service context in the HYCU UI. Click on the question mark in the upper-right corner, followed by "Help with This Page". Scroll down to the "User Roles" section. If users can perform more functions than those specified for their role, this is a finding.

✔️ Fix
Apply the appropriate user role to the required user from one of the predefined and nonchangeable roles: Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer.