Versions Compared

Old Version 7

changes.mady.by.user Pankaj Goyal

Saved on

compared with

New Version Current

changes.mady.by.user Pankaj Goyal

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...


VNF Security RefDescriptionNotes
CNTT RelevantExistsCNTT Ref#Current Description, if existsRecommended Description (may be a modification of existing)
1R-23135 The VNF MUST, if not integrated with the Operator’s identity and access management system, authenticate all access to protected resources.






2R-231402 The VNF MUST provide a means to explicitly logout, thus ending that session.

YN

The Platform must provide a means to explicitly logout from an interactive session, thus ending that session.

The Platform must provide a means to automatically logout, thus ending that session, of any interactive session after a configurable period of inactivity.

3R-251639 The VNF MUST provide explicit confirmation of a session termination such as a message, new page, or rerouting to a login page.






4R-358699 The VNF MUST support at least the following roles: system administrator, application administrator, network function O&M.






5R-373737 The VNF MUST, if not integrated with the operator’s IAM system, provide a mechanism for assigning roles and/or permissions to an identity.






6R-39562 The VNF MUST disable unnecessary or vulnerable cgi-bin programs.






7R-42874 The VNF MUST allow the Operator to restrict access to protected resources based on the assigned permissions associated with an ID in order to support Least Privilege (no more privilege than required to perform job functions).






8R-45719 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, enforce a configurable “terminate idle sessions” policy by terminating the session after a configurable period of inactivity.






9R-46908 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, comply with “password complexity” policy. When passwords are used, they shall be complex and shall at least meet the following password construction requirements: (1) be a minimum configurable number of characters in length, (2) include 3 of the 4 following types of characters: upper-case alphabetic, lower-case alphabetic, numeric, and special, (3) not be the same as the UserID with which they are associated or other common strings as specified by the environment, (4) not contain repeating or sequential characters or numbers, (5) not to use special characters that may have command functions, and (6) new passwords must not contain sequences of three or more characters from the previous password.

YN
Requirement exists in discussions but not in consolidated requirements

The Platform must ensure compliance with password complexity policy.  When passwords are created, they shall be complex and shall at least meet the following password construction requirements: (1) be a minimum configurable number of characters in length, (2) include 3 of the 4 following types of characters: upper-case alphabetic, lower-case alphabetic, numeric, and special, (3) not be the same as the UserID with which they are associated or other common strings as specified by the environment, (4) not contain repeating or sequential characters or numbers, and (5) not be the same as a password used previously during a configurable period.


The Platform must ensure compliance with password expiry policy. Passwords expire after a configurable period of time. Passwords expire for non-use after a configurable period of time. 

10R-479386 The VNF MUST provide the capability of setting a configurable message to be displayed after successful login. It MAY provide a list of supported character sets.






11R-581188 The VNF MUST NOT identify the reason for a failed authentication, only that the authentication failed.

YN

The Platform must not identify the reason for a failed authentication, only that the authentication failed.


The Platform must limit the number of failed authentication attempts to a configurable number. When the number of failed attempts is reached, the platform must disable the user account; user account can be enabled by an administrator.

12R-59391 The VNF MUST NOT allow the assumption of the permissions of another account to mask individual accountability. For example, use SUDO when a user requires elevated permissions such as root or admin.






13R-75041 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support configurable password expiration.






14R-78010 The VNF MUST support LDAP in order to integrate with an external identity and access manage system. It MAY support other identity and access management protocols.

YN

The Platform must support LDAP in order to integrate with an external identity and access manage system. It MAY support other identity and access management protocols.
15R-79107 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the ability to lock out the userID after a configurable number of consecutive unsuccessful authentication attempts using the same userID. The locking mechanism must be reversible by an administrator and should be reversible after a configurable time period.






16R-81147 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support multifactor authentication on all protected interfaces exposed by the VNF for use by human users.






17R-814377 The VNF MUST have the capability of allowing the Operator to create, manage, and automatically provision user accounts using one of the protocols specified in Chapter 7.






18R-844011 The VNF MUST not store authentication credentials to itself in clear text or any reversible form and must use salting.






19R-86835 The VNF MUST set the default settings for user access to deny authorization, except for a super user type of account.






20R-931076 The VNF MUST support account names that contain at least A-Z, a-z, and 0-9 character sets and be at least 6 characters in length.






21R-99174 The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the creation of multiple IDs so that individual accountability can be supported.






...