RubyGems - kriterion - Versions diffs - 0.0.1 - Mend

kriterion 0.0.1

Files changed (564) hide show

checksums.yaml +7 -0
data/.gitignore +2 -0
data/.ruby-version +1 -0
data/.travis.yml +5 -0
data/Dockerfile +18 -0
data/Gemfile +12 -0
data/Gemfile.lock +62 -0
data/LICENSE.txt +21 -0
data/README.md +58 -0
data/Rakefile +6 -0
data/bin/setup +8 -0
data/bin/update_stigs.rb +42 -0
data/criterion.gemspec +31 -0
data/docker-compose.yml +14 -0
data/exe/kriterion +16 -0
data/lib/kriterion.rb +16 -0
data/lib/kriterion/api.rb +27 -0
data/lib/kriterion/backend.rb +13 -0
data/lib/kriterion/backend/mongodb.rb +235 -0
data/lib/kriterion/cli.rb +28 -0
data/lib/kriterion/cli/api.rb +35 -0
data/lib/kriterion/cli/worker.rb +35 -0
data/lib/kriterion/event.rb +36 -0
data/lib/kriterion/item.rb +42 -0
data/lib/kriterion/logs.rb +14 -0
data/lib/kriterion/metrics.rb +22 -0
data/lib/kriterion/object.rb +50 -0
data/lib/kriterion/report.rb +69 -0
data/lib/kriterion/resource.rb +60 -0
data/lib/kriterion/section.rb +32 -0
data/lib/kriterion/standard.rb +65 -0
data/lib/kriterion/version.rb +3 -0
data/lib/kriterion/worker.rb +280 -0
data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
data/standards/stig_a10_networks_adc_alg.json +209 -0
data/standards/stig_a10_networks_adc_ndm.json +233 -0
data/standards/stig_active_directory_domain.json +257 -0
data/standards/stig_active_directory_forest.json +41 -0
data/standards/stig_active_directory_service_2003.json +173 -0
data/standards/stig_active_directory_service_2008.json +167 -0
data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
data/standards/stig_adobe_coldfusion_11.json +611 -0
data/standards/stig_airwatch_mdm.json +185 -0
data/standards/stig_aix_5.3.json +3095 -0
data/standards/stig_aix_6.1.json +3047 -0
data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
data/standards/stig_android_2.2_dell.json +311 -0
data/standards/stig_apache_2.2_serverwindows.json +347 -0
data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
data/standards/stig_apache_server_2.0unix.json +341 -0
data/standards/stig_apache_server_2.0windows.json +341 -0
data/standards/stig_apache_server_2.2unix.json +347 -0
data/standards/stig_apache_server_2.2windows.json +347 -0
data/standards/stig_apache_site_2.0unix.json +185 -0
data/standards/stig_apache_site_2.0windows.json +179 -0
data/standards/stig_apache_site_2.2unix.json +185 -0
data/standards/stig_apache_site_2.2windows.json +179 -0
data/standards/stig_apple_ios6.json +341 -0
data/standards/stig_apple_ios_10.json +245 -0
data/standards/stig_apple_ios_11.json +269 -0
data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
data/standards/stig_apple_ios_5.json +329 -0
data/standards/stig_apple_ios_6.json +335 -0
data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
data/standards/stig_apple_ios_7.json +185 -0
data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
data/standards/stig_apple_os_x_10.11.json +725 -0
data/standards/stig_apple_os_x_10.12.json +737 -0
data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
data/standards/stig_application_security_and_development.json +1745 -0
data/standards/stig_application_security_and_development_checklist.json +959 -0
data/standards/stig_application_security_requirements_guide.json +1961 -0
data/standards/stig_application_server_security_requirements_guide.json +791 -0
data/standards/stig_arcgisserver_10.3.json +143 -0
data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
data/standards/stig_bind_9.x.json +431 -0
data/standards/stig_bind_dns.json +317 -0
data/standards/stig_blackberry_10.2.x_os.json +179 -0
data/standards/stig_blackberry_10_os.json +227 -0
data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
data/standards/stig_blackberry_device_service_6.2.json +425 -0
data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
data/standards/stig_blackberry_handheld_device.json +125 -0
data/standards/stig_blackberry_os_10.3.x.json +257 -0
data/standards/stig_blackberry_os_7.x.json +107 -0
data/standards/stig_blackberry_os_7.x.x.json +101 -0
data/standards/stig_blackberry_os_version_5-7.json +107 -0
data/standards/stig_blackberry_playbook.json +65 -0
data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
data/standards/stig_blackberry_uem_12.7.json +59 -0
data/standards/stig_bluetoothzigbee.json +35 -0
data/standards/stig_ca_api_gateway_alg.json +497 -0
data/standards/stig_cisco_css_dns.json +71 -0
data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
data/standards/stig_cmd_management_server_policy.json +53 -0
data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
data/standards/stig_database_security_requirements_guide.json +767 -0
data/standards/stig_dbn-6300_idps.json +107 -0
data/standards/stig_dbn-6300_ndm.json +359 -0
data/standards/stig_defense_switched_network.json +683 -0
data/standards/stig_defense_switched_network_dsn.json +653 -0
data/standards/stig_desktop_applications_general.json +41 -0
data/standards/stig_dns_policy.json +155 -0
data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
data/standards/stig_draft_aix.json +3503 -0
data/standards/stig_edb_postgres_advanced_server.json +665 -0
data/standards/stig_email_services_policy.json +137 -0
data/standards/stig_exchange_2010_client_access_server.json +179 -0
data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
data/standards/stig_exchange_2010_mailbox_server.json +209 -0
data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
data/standards/stig_final_draft_general_wireless_policy.json +71 -0
data/standards/stig_firewall.json +449 -0
data/standards/stig_firewall_-_cisco.json +449 -0
data/standards/stig_firewall_security_requirements_guide.json +257 -0
data/standards/stig_forescout_counteract_alg.json +83 -0
data/standards/stig_forescout_counteract_ndm.json +239 -0
data/standards/stig_free_space_optics_device.json +143 -0
data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
data/standards/stig_general_wireless_policy.json +71 -0
data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
data/standards/stig_goodenterprise_8.x.json +401 -0
data/standards/stig_google_chrome_browser.json +209 -0
data/standards/stig_google_chrome_current_windows.json +215 -0
data/standards/stig_google_chrome_draft.json +281 -0
data/standards/stig_google_chrome_v23_windows.json +275 -0
data/standards/stig_google_chrome_v24_windows.json +263 -0
data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
data/standards/stig_google_search_appliance.json +209 -0
data/standards/stig_harris_secnet_11_54.json +89 -0
data/standards/stig_hp-ux_11.23.json +3215 -0
data/standards/stig_hp-ux_11.31.json +3155 -0
data/standards/stig_hp-ux_smse.json +431 -0
data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
data/standards/stig_ibm_datapower_alg.json +401 -0
data/standards/stig_ibm_datapower_network_device_management.json +395 -0
data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
data/standards/stig_idsips.json +257 -0
data/standards/stig_iis6_server.json +221 -0
data/standards/stig_iis6_site.json +263 -0
data/standards/stig_iis_7.0_web_server.json +155 -0
data/standards/stig_iis_7.0_web_site.json +299 -0
data/standards/stig_iis_8.5_server.json +293 -0
data/standards/stig_iis_8.5_site.json +347 -0
data/standards/stig_infoblox_7.x_dns.json +419 -0
data/standards/stig_infrastructure_l3_switch.json +599 -0
data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
data/standards/stig_infrastructure_router.json +479 -0
data/standards/stig_infrastructure_router_-_cisco.json +539 -0
data/standards/stig_infrastructure_router_-_juniper.json +485 -0
data/standards/stig_infrastructure_router__cisco.json +539 -0
data/standards/stig_infrastructure_router__juniper.json +485 -0
data/standards/stig_internet_explorer_8.json +821 -0
data/standards/stig_internet_explorer_9.json +815 -0
data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
data/standards/stig_ipsec_vpn_gateway.json +521 -0
data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
data/standards/stig_jboss_eap_6.3.json +413 -0
data/standards/stig_juniper_srx_sg_alg.json +155 -0
data/standards/stig_juniper_srx_sg_idps.json +179 -0
data/standards/stig_juniper_srx_sg_ndm.json +443 -0
data/standards/stig_juniper_srx_sg_vpn.json +185 -0
data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
data/standards/stig_layer_2_switch.json +347 -0
data/standards/stig_layer_2_switch_-_cisco.json +365 -0
data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
data/standards/stig_lg_android_6.x.json +281 -0
data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
data/standards/stig_mcafee_application_control_7.x.json +203 -0
data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
data/standards/stig_mdm_server_policy.json +47 -0
data/standards/stig_microsoft_access_2003.json +47 -0
data/standards/stig_microsoft_access_2007.json +77 -0
data/standards/stig_microsoft_access_2010.json +119 -0
data/standards/stig_microsoft_access_2013.json +113 -0
data/standards/stig_microsoft_access_2016.json +107 -0
data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
data/standards/stig_microsoft_excel_2003.json +47 -0
data/standards/stig_microsoft_excel_2007.json +155 -0
data/standards/stig_microsoft_excel_2010.json +287 -0
data/standards/stig_microsoft_excel_2013.json +293 -0
data/standards/stig_microsoft_excel_2016.json +257 -0
data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
data/standards/stig_microsoft_exchange_server_2003.json +647 -0
data/standards/stig_microsoft_groove_2013.json +71 -0
data/standards/stig_microsoft_ie_version_6.json +599 -0
data/standards/stig_microsoft_ie_version_7.json +749 -0
data/standards/stig_microsoft_infopath_2003.json +41 -0
data/standards/stig_microsoft_infopath_2007.json +167 -0
data/standards/stig_microsoft_infopath_2010.json +155 -0
data/standards/stig_microsoft_infopath_2013.json +149 -0
data/standards/stig_microsoft_internet_explorer_10.json +857 -0
data/standards/stig_microsoft_internet_explorer_11.json +839 -0
data/standards/stig_microsoft_internet_explorer_9.json +821 -0
data/standards/stig_microsoft_lync_2013.json +29 -0
data/standards/stig_microsoft_office_system_2007.json +221 -0
data/standards/stig_microsoft_office_system_2010.json +233 -0
data/standards/stig_microsoft_office_system_2013.json +293 -0
data/standards/stig_microsoft_office_system_2016.json +131 -0
data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
data/standards/stig_microsoft_onenote_2010.json +77 -0
data/standards/stig_microsoft_onenote_2013.json +71 -0
data/standards/stig_microsoft_onenote_2016.json +71 -0
data/standards/stig_microsoft_outlook_2003.json +65 -0
data/standards/stig_microsoft_outlook_2007.json +479 -0
data/standards/stig_microsoft_outlook_2010.json +515 -0
data/standards/stig_microsoft_outlook_2013.json +497 -0
data/standards/stig_microsoft_outlook_2016.json +359 -0
data/standards/stig_microsoft_powerpoint_2003.json +47 -0
data/standards/stig_microsoft_powerpoint_2007.json +131 -0
data/standards/stig_microsoft_powerpoint_2010.json +191 -0
data/standards/stig_microsoft_powerpoint_2013.json +251 -0
data/standards/stig_microsoft_powerpoint_2016.json +233 -0
data/standards/stig_microsoft_project_2010.json +83 -0
data/standards/stig_microsoft_project_2013.json +95 -0
data/standards/stig_microsoft_project_2016.json +95 -0
data/standards/stig_microsoft_publisher_2010.json +107 -0
data/standards/stig_microsoft_publisher_2013.json +101 -0
data/standards/stig_microsoft_publisher_2016.json +101 -0
data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
data/standards/stig_microsoft_visio_2013.json +89 -0
data/standards/stig_microsoft_visio_2016.json +89 -0
data/standards/stig_microsoft_windows_10_mobile.json +215 -0
data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
data/standards/stig_microsoft_word_2003.json +47 -0
data/standards/stig_microsoft_word_2007.json +119 -0
data/standards/stig_microsoft_word_2010.json +221 -0
data/standards/stig_microsoft_word_2013.json +221 -0
data/standards/stig_microsoft_word_2016.json +215 -0
data/standards/stig_mobile_application_management_mam_server.json +95 -0
data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
data/standards/stig_mobile_device_management_mdm_server.json +125 -0
data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
data/standards/stig_mobile_email_management_mem_server.json +197 -0
data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
data/standards/stig_mobile_policy.json +35 -0
data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
data/standards/stig_mobility_policy.json +65 -0
data/standards/stig_mozilla_firefox.json +161 -0
data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
data/standards/stig_ms_sharepoint_2010.json +269 -0
data/standards/stig_ms_sharepoint_2013.json +245 -0
data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
data/standards/stig_ms_sql_server_2014_database.json +263 -0
data/standards/stig_ms_sql_server_2014_instance.json +575 -0
data/standards/stig_ms_sql_server_2016_database.json +185 -0
data/standards/stig_ms_sql_server_2016_instance.json +731 -0
data/standards/stig_ms_windows_defender_antivirus.json +257 -0
data/standards/stig_multifunction_device_and_network_printers.json +131 -0
data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
data/standards/stig_network_devices.json +389 -0
data/standards/stig_network_infrastructure_policy.json +455 -0
data/standards/stig_network_security_requirements_guide.json +1961 -0
data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
data/standards/stig_oracle_10_database_installation.json +527 -0
data/standards/stig_oracle_10_database_instance.json +569 -0
data/standards/stig_oracle_11_database_installation.json +527 -0
data/standards/stig_oracle_11_database_instance.json +551 -0
data/standards/stig_oracle_database_10g_installation.json +527 -0
data/standards/stig_oracle_database_10g_instance.json +581 -0
data/standards/stig_oracle_database_11.2g.json +1229 -0
data/standards/stig_oracle_database_11g_installation.json +527 -0
data/standards/stig_oracle_database_11g_instance.json +575 -0
data/standards/stig_oracle_database_12c.json +1217 -0
data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
data/standards/stig_oracle_linux_5.json +3431 -0
data/standards/stig_oracle_linux_6.json +1583 -0
data/standards/stig_oracle_weblogic_server_12c.json +443 -0
data/standards/stig_palo_alto_networks_alg.json +311 -0
data/standards/stig_palo_alto_networks_idps.json +185 -0
data/standards/stig_palo_alto_networks_ndm.json +251 -0
data/standards/stig_pda.json +83 -0
data/standards/stig_pdasmartphone.json +95 -0
data/standards/stig_perimeter_l3_switch.json +923 -0
data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
data/standards/stig_perimeter_router.json +803 -0
data/standards/stig_perimeter_router_cisco.json +881 -0
data/standards/stig_perimeter_router_juniper.json +803 -0
data/standards/stig_postgresql_9.x.json +677 -0
data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
data/standards/stig_remote_access_policy.json +317 -0
data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
data/standards/stig_removable_storage_and_external_connections.json +137 -0
data/standards/stig_rfid_scanner.json +35 -0
data/standards/stig_rfid_workstation.json +23 -0
data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
data/standards/stig_router_security_requirements_guide.json +575 -0
data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
data/standards/stig_samsung_knox_android_1.0.json +167 -0
data/standards/stig_sharepoint_2010.json +269 -0
data/standards/stig_sharepoint_2013.json +245 -0
data/standards/stig_smartphone_policy.json +131 -0
data/standards/stig_solaris_10_sparc.json +3029 -0
data/standards/stig_solaris_10_x86.json +3065 -0
data/standards/stig_solaris_11_sparc.json +1427 -0
data/standards/stig_solaris_11_x86.json +1421 -0
data/standards/stig_solaris_9_sparc.json +2915 -0
data/standards/stig_solaris_9_x86.json +2915 -0
data/standards/stig_sun_ray_4.json +185 -0
data/standards/stig_sun_ray_4_policy.json +77 -0
data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
data/standards/stig_tanium_6.5.json +461 -0
data/standards/stig_tanium_7.0.json +803 -0
data/standards/stig_test_and_development_zone_a.json +167 -0
data/standards/stig_test_and_development_zone_b.json +179 -0
data/standards/stig_test_and_development_zone_c.json +143 -0
data/standards/stig_test_and_development_zone_d.json +143 -0
data/standards/stig_traditional_security.json +917 -0
data/standards/stig_unix_srg.json +3287 -0
data/standards/stig_video_services_policy.json +497 -0
data/standards/stig_video_teleconference.json +47 -0
data/standards/stig_video_teleconference_vtc.json +12 -0
data/standards/stig_vmware_esx_3_policy.json +155 -0
data/standards/stig_vmware_esx_3_server.json +3791 -0
data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
data/standards/stig_vmware_esxi_server_5.0.json +809 -0
data/standards/stig_vmware_esxi_v5.json +5177 -0
data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
data/standards/stig_vmware_nsx_manager.json +191 -0
data/standards/stig_vmware_vcenter_server.json +179 -0
data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
data/standards/stig_voice_video_services_policy.json +671 -0
data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
data/standards/stig_voicevideo_services_policy.json +569 -0
data/standards/stig_web_policy.json +95 -0
data/standards/stig_web_server.json +317 -0
data/standards/stig_web_server_security_requirements_guide.json +587 -0
data/standards/stig_win2k3_audit.json +761 -0
data/standards/stig_win2k8_audit.json +1085 -0
data/standards/stig_win2k8_r2_audit.json +1637 -0
data/standards/stig_win7_audit.json +1613 -0
data/standards/stig_windows_10.json +1691 -0
data/standards/stig_windows_2003_domain_controller.json +893 -0
data/standards/stig_windows_2003_member_server.json +845 -0
data/standards/stig_windows_2008_domain_controller.json +1475 -0
data/standards/stig_windows_2008_member_server.json +1301 -0
data/standards/stig_windows_7.json +1781 -0
data/standards/stig_windows_8.json +2399 -0
data/standards/stig_windows_88.1.json +2273 -0
data/standards/stig_windows_8_8.1.json +2297 -0
data/standards/stig_windows_defender_antivirus.json +239 -0
data/standards/stig_windows_dns.json +185 -0
data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
data/standards/stig_windows_paw.json +155 -0
data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
data/standards/stig_windows_server_2012_member_server.json +2249 -0
data/standards/stig_windows_server_2016.json +1661 -0
data/standards/stig_windows_vista.json +1517 -0
data/standards/stig_windows_xp.json +893 -0
data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
data/standards/stig_wireless_management_server_policy.json +53 -0
data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
data/standards/stig_wlan_access_point_policy.json +17 -0
data/standards/stig_wlan_authentication_server.json +29 -0
data/standards/stig_wlan_bridge.json +209 -0
data/standards/stig_wlan_client.json +65 -0
data/standards/stig_wlan_controller.json +215 -0
data/standards/stig_wlan_ids_sensorserver.json +23 -0
data/standards/stig_wman_access_point.json +263 -0
data/standards/stig_wman_bridge.json +209 -0
data/standards/stig_wman_subscriber.json +65 -0
data/standards/stig_zos_acf2.json +1451 -0
data/standards/stig_zos_bmc_control-dacf2.json +53 -0
data/standards/stig_zos_bmc_control-dracf.json +59 -0
data/standards/stig_zos_bmc_control-dtss.json +65 -0
data/standards/stig_zos_bmc_control-macf2.json +59 -0
data/standards/stig_zos_bmc_control-mracf.json +65 -0
data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
data/standards/stig_zos_bmc_control-mtss.json +71 -0
data/standards/stig_zos_bmc_control-oacf2.json +53 -0
data/standards/stig_zos_bmc_control-oracf.json +59 -0
data/standards/stig_zos_bmc_control-otss.json +65 -0
data/standards/stig_zos_bmc_ioaacf2.json +53 -0
data/standards/stig_zos_bmc_ioaracf.json +59 -0
data/standards/stig_zos_bmc_ioatss.json +65 -0
data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
data/standards/stig_zos_ca_auditoracf2.json +29 -0
data/standards/stig_zos_ca_auditorracf.json +29 -0
data/standards/stig_zos_ca_auditortss.json +29 -0
data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
data/standards/stig_zos_ca_common_servicesracf.json +29 -0
data/standards/stig_zos_ca_common_servicestss.json +29 -0
data/standards/stig_zos_ca_micsacf2.json +23 -0
data/standards/stig_zos_ca_micsracf.json +23 -0
data/standards/stig_zos_ca_micstss.json +23 -0
data/standards/stig_zos_ca_mimacf2.json +41 -0
data/standards/stig_zos_ca_mimracf.json +47 -0
data/standards/stig_zos_ca_mimtss.json +47 -0
data/standards/stig_zos_ca_vtapeacf2.json +29 -0
data/standards/stig_zos_ca_vtaperacf.json +35 -0
data/standards/stig_zos_ca_vtapetss.json +35 -0
data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
data/standards/stig_zos_catalog_solutionsracf.json +23 -0
data/standards/stig_zos_catalog_solutionstss.json +23 -0
data/standards/stig_zos_clsupersessionacf2.json +53 -0
data/standards/stig_zos_clsupersessionracf.json +65 -0
data/standards/stig_zos_clsupersessiontss.json +71 -0
data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
data/standards/stig_zos_cssmtpacf2.json +23 -0
data/standards/stig_zos_cssmtpracf.json +29 -0
data/standards/stig_zos_cssmtptss.json +29 -0
data/standards/stig_zos_fdracf2.json +23 -0
data/standards/stig_zos_fdrracf.json +23 -0
data/standards/stig_zos_fdrtss.json +23 -0
data/standards/stig_zos_hcdacf2.json +29 -0
data/standards/stig_zos_hcdracf.json +29 -0
data/standards/stig_zos_hcdtss.json +29 -0
data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
data/standards/stig_zos_ibm_health_checkertss.json +29 -0
data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
data/standards/stig_zos_icsfacf2.json +29 -0
data/standards/stig_zos_icsfracf.json +35 -0
data/standards/stig_zos_icsftss.json +35 -0
data/standards/stig_zos_netviewacf2.json +41 -0
data/standards/stig_zos_netviewracf.json +47 -0
data/standards/stig_zos_netviewtss.json +53 -0
data/standards/stig_zos_quest_nc-passacf2.json +35 -0
data/standards/stig_zos_quest_nc-passracf.json +41 -0
data/standards/stig_zos_quest_nc-passtss.json +47 -0
data/standards/stig_zos_racf.json +1415 -0
data/standards/stig_zos_roscoeacf2.json +47 -0
data/standards/stig_zos_roscoeracf.json +53 -0
data/standards/stig_zos_roscoetss.json +59 -0
data/standards/stig_zos_srrauditacf2.json +23 -0
data/standards/stig_zos_srrauditracf.json +23 -0
data/standards/stig_zos_srraudittss.json +23 -0
data/standards/stig_zos_tadzacf2.json +29 -0
data/standards/stig_zos_tadzracf.json +35 -0
data/standards/stig_zos_tadztss.json +35 -0
data/standards/stig_zos_tdmfacf2.json +23 -0
data/standards/stig_zos_tdmfracf.json +23 -0
data/standards/stig_zos_tdmftss.json +23 -0
data/standards/stig_zos_tss.json +1523 -0
data/standards/stig_zos_vssracf.json +29 -0
metadata +691 -0

data/standards/stig_oracle_11_database_installation.json ADDED

@@ -0,0 +1,527 @@
+{
+  "name": "stig_oracle_11_database_installation",
+  "date": "2014-01-14",
+  "description": "This STIG include the Database Installation checks for an Oracle 11G database installation.",
+  "title": "Oracle 11 Database Installation STIG",
+  "version": "8",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-15102",
+      "title": "Automated notification of suspicious activity detected in the audit trail should be implemented.",
+      "description": "Audit record collection may quickly overwhelm storage resources and an auditor's ability to review it in a productive manner. Automated tools can provide the means to manage the audit data collected as well as present it to an auditor in an efficient way.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15103",
+      "title": "An automated tool that monitors audit data and immediately reports suspicious activity should be employed for the DBMS.",
+      "description": "Audit logs only capture information on suspicious events. Without an automated monitoring and alerting tool, malicious activity may go undetected and without response until compromise of the database or data is severe.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15104",
+      "title": "Sensitive data served by the DBMS should be protected by encryption when transmitted across the network.",
+      "description": "Sensitive data served by the DBMS and transmitted across the network in clear text is vulnerable to unauthorized capture and review.",
+      "severity": "high"
+    },
+    {
+      "id": "V-15105",
+      "title": "Unauthorized access to external database objects should be removed from application user roles.",
+      "description": "Access to objects stored and/or executed outside of the DBMS security context may provide an avenue of attack to host system resources not controlled by the DBMS. Any access to external resources from the DBMS can lead to a compromise of the host system or its resources.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15106",
+      "title": "DBA roles should be periodically monitored to detect assignment of unauthorized or excess privileges.",
+      "description": "Excess privilege assignment can lead to intentional or unintentional unauthorized actions. Such actions may compromise the operation or integrity of the DBMS and its data. Monitoring assigned privileges assists in the detection of unauthorized privilege assignment. The DBA role is assigned privileges that allow DBAs to modify privileges assigned to them. Ensure that the DBA Role is monitored for any unauthorized changes.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15107",
+      "title": "DBMS privileges to restore database data or other DBMS configurations, features or objects should be restricted to authorized DBMS accounts.",
+      "description": "Unauthorized restoration of database data, objects, or other configuration or features can result in a loss of data integrity, unauthorized configuration, or other DBMS interruption or compromise.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15108",
+      "title": "Privileges assigned to developers on shared production and development DBMS hosts and the DBMS should be monitored every three months or more frequently for unauthorized changes.",
+      "description": "The developer role does not include need-to-know or administrative privileges to production databases. Assigning excess privileges can lead to unauthorized access to sensitive data or compromise of database operations.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15109",
+      "title": "DBMS production application and data directories should be protected from developers on shared production/development DBMS host systems.\n",
+      "description": "Developer roles should not be assigned DBMS administrative privileges to production DBMS application and data directories. The separation of production DBA and developer roles helps protect the production system from unauthorized, malicious or unintentional interruption due to development activities.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15110",
+      "title": "Use of the DBMS installation account should be logged.",
+      "description": "The DBMS installation account may be used by any authorized user to perform DBMS installation or maintenance. Without logging, accountability for actions attributed to the account is lost.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15111",
+      "title": "Use of the DBMS software installation account should be restricted to DBMS software installation, upgrade and maintenance actions.",
+      "description": "The DBMS software installation account is granted privileges not required for DBA or other functions. Use of accounts configured with excess privileges may result in unauthorized or unintentional compromise of the DBMS.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15112",
+      "title": "The DBMS should be periodically tested for vulnerability management and IA compliance.",
+      "description": "The DBMS security configuration may be altered either intentionally or unintentionally over time. The DBMS may also be the subject of published vulnerabilities that require the installation of a security patch or a reconfiguration to mitigate the vulnerability. If the DBMS is not monitored for required or unintentional changes that render it not compliant with requirements, then it can be vulnerable to attack or compromise.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15116",
+      "title": "The DBMS host platform and other dependent applications should be configured in compliance with applicable STIG requirements.",
+      "description": "The security of the data stored in the DBMS is also vulnerable to attacks against the host platform, calling applications, and other application or optional components.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15117",
+      "title": "The DBMS audit logs should be included in backup operations.",
+      "description": "DBMS audit logs are essential to the investigation and prosecution of unauthorized access to the DBMS data. Unless audit logs are available for review, the extent of data compromise may not be determined and the vulnerability exploited may not be discovered. Undiscovered vulnerabilities could lead to additional or prolonged compromise of the data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15118",
+      "title": "Remote administrative access to the database should be monitored by the IAO or IAM.",
+      "description": "Remote administrative access to systems provides a path for access to and exploit of DBA privileges. Where the risk has been accepted to allow remote administrative access, it is imperative to instate increased monitoring of this access to detect any abuse or compromise.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15120",
+      "title": "DBMS backup and restoration files should be protected from unauthorized access.",
+      "description": "Lost or compromised DBMS backup and restoration files may lead to not only the loss of data, but also the unauthorized access to sensitive data. Backup files need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss. Most DBMSs maintain online copies of critical control files to provide transparent or easy recovery from hard disk loss or other interruptions to database operation.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15121",
+      "title": "DBMS software libraries should be periodically backed up.",
+      "description": "The DBMS application depends upon the availability and integrity of its software libraries. Without backups, compromise or loss of the software libraries can prevent a successful recovery of DBMS operations.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15122",
+      "title": "The database should not be directly accessible from public or unauthorized networks.",
+      "description": "Databases often store critical and/or sensitive information used by the organization. For this reason, databases are targeted for attacks by malicious users. Additional protections provided by network defenses that limit accessibility help protect the database and its data from unnecessary exposure and risk.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15126",
+      "title": "Database backup procedures should be defined, documented and implemented.",
+      "description": "Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15127",
+      "title": "The IAM should review changes to DBA role assignments.",
+      "description": "Unauthorized assignment of DBA privileges can lead to a compromise of DBMS integrity. Providing oversight to the authorization and assignment of privileges provides the separation of duty to support sufficient oversight.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15129",
+      "title": "Backup and recovery procedures should be developed, documented, implemented and periodically tested.",
+      "description": "Problems with backup procedures or backup media may not be discovered until after a recovery is needed. Testing and verification of procedures provides the opportunity to discover oversights, conflicts, or other issues in the backup procedures or use of media designed to be used.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15131",
+      "title": "Sensitive information stored in the database should be protected by encryption.\n",
+      "description": "Sensitive data stored in unencrypted format within the database is vulnerable to unauthorized viewing.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15132",
+      "title": "Database data files containing sensitive information should be encrypted.",
+      "description": "Where system and DBMS access controls do not provide complete protection of sensitive or classified information, the Information Owner may require encryption to provide additional protection. Encryption of sensitive data helps protect disclosure to privileged users who do not have a need-to-know requirement to the data, but may be able to access DBMS data files using OS file tools.\n\nNOTE:  The decision to encrypt data is the responsibility of the Information Owner and should be based on other access controls employed to protect the data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15138",
+      "title": "The DBMS IA policies and procedures should be reviewed annually or more frequently.",
+      "description": "A regular review of current database security policies and procedures is necessary to maintain the desired security posture of the DBMS. Policies and procedures should be measured against current DoD policy, STIG guidance, vendor-specific guidance and recommendations, and site-specific or other security policies.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15139",
+      "title": "Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation.",
+      "description": "Updates and patches to existing software have the intention of improving the security or enhancing or adding features to the product. However, it is unfortunately common that updates or patches can render production systems inoperable or even introduce serious vulnerabilities. Some updates also set security configurations back to unacceptable settings that do not meet security requirements. For these reasons, it is a good practice to test updates and patches offline before introducing them in a production environment.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15140",
+      "title": "Procedures and restrictions for import of production data to development databases should be documented, implemented and followed.",
+      "description": "Data export from production databases may include sensitive data. Application developers may not be cleared for or have need-to-know to sensitive data. Any access they may have to production data would be considered unauthorized access and subject the sensitive data to unlawful or unauthorized disclosure.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15141",
+      "title": "DBMS processes or services should run under custom, dedicated OS accounts.",
+      "description": "Shared accounts do not provide separation of duties nor allow for assignment of least privileges for use by database processes and services. Without separation and least privilege, the exploit of one service or process is more likely to be able to compromise another or all other services.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15143",
+      "title": "Database data encryption controls should be configured in accordance with application requirements.",
+      "description": "Access to sensitive data may not always be sufficiently protected by authorizations and require encryption. In some cases, the required encryption may be provided by the application accessing the database. In others, the DBMS may be configured to provide the data encryption. When the DBMS provides the encryption, the requirement must be implemented as identified by the Information Owner to prevent unauthorized disclosure or access.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15144",
+      "title": "Sensitive data is stored in the database and should be identified in the System Security Plan and AIS Functional Architecture documentation.",
+      "description": "A DBMS that does not have the correct confidentiality level identified or any confidentiality level assigned is not being secured at a level appropriate to the risk it poses.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15145",
+      "title": "The DBMS restoration priority should be assigned.",
+      "description": "When DBMS service is disrupted, the impact it has on the overall mission of the organization can be severe. Without proper assignment of the priority placed on restoration of the DBMS and its subsystems, restoration of DBMS services may not meet mission requirements.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15146",
+      "title": "The DBMS should not be operated without authorization on a host system supporting other application services.",
+      "description": "In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system. A DBMS not installed on a dedicated host is threatened by other hosted applications. Applications that share a single DBMS may also create risk to one another. Access controls defined for one application by default may provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15147",
+      "title": "The DBMS data files, transaction logs and audit files should be stored in dedicated directories or disk partitions separate from software or other application files.",
+      "description": "Protection of DBMS data, transaction and audit data files stored by the host operating system is dependent on OS controls. When different applications share the same database process, resource contention and differing security controls may be required to isolate and protect one application's data and audit logs from another. DBMS software libraries and configuration files also require differing access control lists.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15148",
+      "title": "DBMS network communications should comply with PPS usage restrictions.",
+      "description": "Non-standard network ports, protocol or services configuration or usage could lead to bypass of network perimeter security controls and protections.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15150",
+      "title": "The DBMS requires a System Security Plan containing all required information.",
+      "description": "A System Security Plan identifies security control applicability and configuration for the DBMS. It also contains security control documentation requirements. Security controls applicable to the DBMS may not be documented, tracked or followed if not identified in the System Security Plan. Any omission of security control consideration could lead to an exploit of DBMS vulnerabilities.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15179",
+      "title": "The DBMS should not share a host supporting an independent security service.",
+      "description": "The Security Support Structure is a security control function or service provided by an external system or application. An example of this would be a Windows domain controller that provides identification and authentication that can be used by other systems to control access. The associated risk of a DBMS installed on a system that provides security support is significantly higher than when installed on separate systems. In cases where the DBMS is dedicated to local support of a security support function (e.g. a directory service), separation may not be possible.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15608",
+      "title": "Access to DBMS software files and directories should not be granted to unauthorized users.",
+      "description": "The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in malicious alteration or planting of operational executables. This may in turn jeopardize data stored in the DBMS and/or operation of the host system.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15611",
+      "title": "The audit logs should be periodically monitored to discover DBMS access using unauthorized applications.",
+      "description": "Regular and timely reviews of audit records increases the likelihood of early discovery of suspicious activity. Discovery of suspicious behavior can in turn trigger protection responses to minimize or eliminate a negative impact from malicious activity. Use of unauthorized application to access the DBMS may indicate an attempt to bypass security controls.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15618",
+      "title": "Access to external DBMS executables should be disabled or restricted.",
+      "description": "The Oracle external procedure capability provides use of the Oracle process account outside the operation of the DBMS process. You can use it to submit and execute applications stored externally from the database under operating system controls. The external procedure process is the subject of frequent and successful attacks as it allows unauthenticated use of the Oracle process account on the operating system. As of Oracle version 11.1, the external procedure agent may be run directly from the database and not require use of the Oracle listener. This reduces the risk of unauthorized access to the procedure from outside of the database process.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15620",
+      "title": "OS accounts used to execute external procedures should be assigned minimum privileges.",
+      "description": "External applications spawned by the DBMS process may be executed under OS accounts assigned unnecessary privileges that can lead to unauthorized access to OS resources. Unauthorized access to OS resources can lead to the compromise of the OS, the DBMS, and any other service provided by the host platform.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15621",
+      "title": "Network access to the DBMS must be restricted to authorized personnel.",
+      "description": "Restricting remote access to specific, trusted systems helps prevent access by unauthorized and potentially malicious users.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15622",
+      "title": "DBMS service identification should be unique and clearly identifies the service.",
+      "description": "Local or network services that do not employ unique or clearly identifiable targets can lead to inadvertent or unauthorized connections.",
+      "severity": "low"
+    },
+    {
+      "id": "V-15625",
+      "title": "Recovery procedures and technical system features exist to ensure that recovery is done\nin a secure and verifiable manner.",
+      "description": "A DBMS may be vulnerable to use of compromised data or other critical files during recovery. Use of compromised files could introduce maliciously altered application code, relaxed security settings or loss of data integrity. Where available, DBMS mechanisms to ensure use of only trusted files can help protect the database from this type of compromise during DBMS recovery.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15636",
+      "title": "Passwords should be encrypted when transmitted across the network.",
+      "description": "DBMS passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.",
+      "severity": "high"
+    },
+    {
+      "id": "V-15643",
+      "title": "Access to DBMS security data should be audited.",
+      "description": "DBMS security data is useful to malicious users to perpetrate activities that compromise DBMS operations or data integrity. Auditing of access to this data supports forensic and accountability investigations.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15649",
+      "title": "The DBMS should have configured all applicable settings to use trusted files, functions, features, or other components during startup, shutdown, aborts, or other unplanned interruptions.",
+      "description": "The DBMS opens data files and reads configuration files at system startup, system shutdown and during abort recovery efforts. If the DBMS does not verify the trustworthiness of these files, it is vulnerable to malicious alterations of its configuration or unauthorized replacement of data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15651",
+      "title": "Remote DBMS administration should be documented and authorized or disabled.",
+      "description": "Remote administration may expose configuration and sensitive data to unauthorized viewing during transit across the network or allow unauthorized administrative access to the DBMS to remote users.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15652",
+      "title": "DBMS remote administration should be audited.",
+      "description": "When remote administration is available, the vulnerability to attack for administrative access is increased. An audit of remote administrative access provides additional means to discover suspicious activity and to provide accountability for administrative actions completed by remote users.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15656",
+      "title": "The DBMS should not have a connection defined to access or be accessed by a DBMS at a different classification level.",
+      "description": "Applications that access databases and databases connecting to remote databases that differ in their assigned classification levels may expose sensitive data to unauthorized clients. Any interconnections between databases or applications and databases differing in classification levels are required to comply with interface control rules.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15658",
+      "title": "The DBMS warning banner should meet DoD policy requirements.",
+      "description": "Without sufficient warning of monitoring and access restrictions of a system, legal prosecution to assign responsibility for unauthorized or malicious access may not succeed. A warning message provides legal support for such prosecution. Access to the DBMS or the applications used to access the DBMS require this warning to help assign responsibility for database activities.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15659",
+      "title": "Credentials used to access remote databases should be protected by encryption and restricted to authorized users.",
+      "description": "Access to database connection credential stores provides easy access to the database. Unauthorized access to the database can result without controls in place to prevent unauthorized access to the credentials.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-15662",
+      "title": "Remote administration of the DBMS should be restricted to known, dedicated and encrypted network addresses and ports.",
+      "description": "Remote administration provides many conveniences that can assist in the maintenance of the designed security posture of the DBMS. On the other hand, remote administration of the database also provides malicious users the ability to access from the network a highly privileged function. Remote administration needs to be carefully considered and used only when sufficient protections against its abuse can be applied. Encryption and dedication of ports to access remote administration functions can help prevent unauthorized access to it.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-16031",
+      "title": "The Oracle listener.ora file should specify IP addresses rather than host names to identify hosts.",
+      "description": "The use of IP address in place of host names helps to protect against malicious corruption or spoofing of host names. Use of static IP addresses is considered more stable and reliable than use of hostnames or Fully Qualified Domain Names (FQDN).",
+      "severity": "low"
+    },
+    {
+      "id": "V-16032",
+      "title": "Remote administration should be disabled for the Oracle connection manager.",
+      "description": "Remote administration provides a potential opportunity for malicious users to make unauthorized changes to the Connection Manager configuration or interrupt its service.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-16054",
+      "title": "The Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter should not be set to NONE.",
+      "description": "Undetected attacks using bad packets can lead to a successful Denial of Service (DoS) to database clients. Notification of attacks based on a flood of bad packets sent to the database can assist in discovery and response to this type of attack.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-16055",
+      "title": "Oracle Application Express or Oracle HTML DB should not be installed on a production database.",
+      "description": "The Oracle Application Express, formerly called HTML DB, is an application development component installed by default with Oracle. Unauthorized application development can introduce a variety of vulnerabilities to the database.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-16056",
+      "title": "Oracle Configuration Manager should not remain installed on a production system.",
+      "description": "Oracle Configuration Manager (OCM) is a function of the Oracle Software Configuration Manager (SCM). OCM collects system configuration data used for automated upload to systems owned and managed by Oracle to assist in providing customer support. The configuration information about the server that the OCM collects includes IP addresses, hostname, database username, location of datafiles, etc.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-16057",
+      "title": "The SQLNet SQLNET.ALLOWED_LOGON_VERSION parameter should be set to a value of 10 or higher.",
+      "description": "Unsupported Oracle network client installations may introduce vulnerabilities to the database. Restriction to use of supported versions helps to protect the database and helps to enforce newer, more robust security controls.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2420",
+      "title": "Database executable and configuration files should be monitored for unauthorized modifications.",
+      "description": "Changes to files in the DBMS software directory including executable, configuration, script, or batch files can indicate malicious compromise of the software files. Changes to non-executable files, such as log files and data files, do not usually reflect unauthorized changes, but are modified by the DBMS as part of normal operation. These modifications can be ignored.",
+      "severity": "low"
+    },
+    {
+      "id": "V-2422",
+      "title": "The DBMS software installation account should be restricted to authorized users.",
+      "description": "DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a greater impact on database security and operation.  It is especially important to grant access to privileged accounts to only those persons who are qualified and authorized to use them.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2423",
+      "title": "Database software, applications and configuration files should be monitored to discover unauthorized changes.",
+      "description": "Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-2608",
+      "title": "The Oracle Listener should be configured to require administration authentication.",
+      "description": "Oracle listener authentication helps prevent unauthorized administration of the Oracle listener. Unauthorized administration of the listener could lead to DoS exploits; loss of connection audit data, unauthorized reconfiguration or other unauthorized access. This is a Category I finding because privileged access to the listener is not restricted to authorized users. Unauthorized access can result in stopping of the listener (DoS) and overwriting of listener audit logs.",
+      "severity": "high"
+    },
+    {
+      "id": "V-2612",
+      "title": "Oracle SQLNet and listener log files should not be accessible to unauthorized users.",
+      "description": "The SQLNet and Listener log files provide audit data useful to the discovery of suspicious behavior. The log files may contain usernames and passwords in clear text as well as other information that could aid a malicious user with unauthorized access attempts to the database. Generation and protection of these files helps support security monitoring efforts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3440",
+      "title": "Connections by mid-tier web and application systems to the Oracle DBMS should be protected, encrypted and authenticated according to database, web, application, enclave and network requirements.",
+      "description": "Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the middle-tier system located in a DMZ. In cases where systems are located in the DMZ, network communications between both systems must be encrypted. In all cases, the application account requires PKI authentication. IP address restriction to the backend database system, under a separate requirement, provides an additional level of protection.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3497",
+      "title": "The Oracle Listener ADMIN_RESTRICTIONS parameter if present should be set to ON.",
+      "description": "The Oracle listener process can be dynamically configured. By connecting to the listener process directly, usually through the Oracle LSNRCTL utility, a user may change any of the parameters available through the set command. This vulnerability has been used to overwrite the listener log and trace files. The ADMIN_RESTRICTIONS parameter, set in the listener.ora file, prohibits dynamic listener configuration changes and protects the configuration using host operating system security controls.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3726",
+      "title": "Configuration management procedures should be defined and implemented for database software modifications.",
+      "description": "Uncontrolled, untested, or unmanaged changes result in an unreliable security posture. All changes to software libraries related to the database and its use need to be reviewed, considered, and the responsibility for CM assigned. CM responsibilities may appear to cross boundaries. It is important, however, for the boundaries of CM responsibility to be clearly defined and assigned to ensure no libraries or configurations are left unaddressed. Related database application libraries may include third-party DBMS management tools, DBMS stored procedures, or other end-user applications.",
+      "severity": "low"
+    },
+    {
+      "id": "V-3728",
+      "title": "Unused database components, database application software and database objects should be removed from the DBMS system.",
+      "description": "Unused, unnecessary DBMS components increase the attack vector for the DBMS by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.",
+      "severity": "low"
+    },
+    {
+      "id": "V-3803",
+      "title": "A production DBMS installation should not coexist on the same DBMS host with other, non-production DBMS installations.",
+      "description": "Production, development and other non-production DBMS installations have different access and security requirements.  Shared production/non-production DBMS installations secured at a production-level can impede development efforts whereas production/non-production DBMS installations secured at a development-level can lead to exploitation of production-level installations. Production DBMS installations should be kept separate from development, QA, TEST and other non-production DBMS systems.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3805",
+      "title": "Application software should be owned by a Software Application account.",
+      "description": "File and directory ownership imparts full privileges to the owner. These privileges should be restricted to a single, dedicated account to preserve proper chains of ownership and privilege assignment management.",
+      "severity": "low"
+    },
+    {
+      "id": "V-3806",
+      "title": "A baseline of database application software should be documented and maintained.",
+      "description": "Without maintenance of a baseline of current DBMS application software, monitoring for changes cannot be complete and unauthorized changes to the software can go undetected. Changes to the DBMS executables could be the result of intentional or unintentional actions.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3807",
+      "title": "All applications that access the database should be logged in the audit trail.",
+      "description": "Protections and privileges are designed within the database to correspond to access via authorized software. Use of unauthorized software to access the database could indicate an attempt to bypass established permissions. Reviewing the use of application software to the database can lead to discovery of unauthorized access attempts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3809",
+      "title": "A single database connection configuration file should not be used to configure all database clients.",
+      "description": "Many sites distribute a single client database connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access databases not required by all users that may assist in unauthorized access attempts.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3811",
+      "title": "Procedures for establishing temporary passwords that meet DoD password requirements for new accounts should be defined, documented and implemented.",
+      "description": "New accounts authenticated by passwords that are created without a password or with an easily guessed password are vulnerable to unauthorized access. Procedures for creating new accounts with passwords should include the required assignment of a temporary password to be modified by the user upon first use.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3812",
+      "title": "Database account passwords should be stored in encoded or encrypted format whether stored in database objects, external host files, environment variables or any other storage locations.",
+      "description": "Database passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to the DBMS.",
+      "severity": "high"
+    },
+    {
+      "id": "V-3813",
+      "title": "DBMS tools or applications that echo or require a password entry in clear text should be protected from password display.",
+      "description": "Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice should be prohibited and disabled, if possible, by the application. If it cannot be disabled, then users should be strictly instructed not to use this feature. Typically, the application will prompt for this information and accept it without echoing it on the users computer screen.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3825",
+      "title": "Remote adminstrative connections to the database should be encrypted.",
+      "description": "Communications between a client and database service across the network may contain sensitive information including passwords. This is particularly true in the case of administrative activities. Encryption of remote administrative connections to the database ensures confidentiality of configuration, management, and other administrative data.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3827",
+      "title": "Audit trail data should be reviewed daily or more frequently.",
+      "description": "Review of audit trail data provides a means for detection of unauthorized access or attempted access. Frequent and regularly scheduled reviews ensures that such access is discovered in a timely manner.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3842",
+      "title": "The Oracle software installation account should not be granted excessive host system privileges.",
+      "description": "A compromise of the Oracle database process could be used to gain access to the host operating system under the security account of the process owner. Limitation of the privileges assigned to the process account can help contain access to other processes and host system resources. This can in turn help to limit any resulting malicious activity.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3845",
+      "title": "OS DBA group membership should be restricted to authorized accounts.",
+      "description": "Oracle SYSDBA privileges include privileges to administer the database outside of database controls (when the database is shut down) in addition to all privileges controlled under database operation. Assignment of membership to the OS dba group to unauthorized persons can compromise all DBMS activities.",
+      "severity": "low"
+    },
+    {
+      "id": "V-3862",
+      "title": "The Oracle INBOUND_CONNECT_TIMEOUT and SQLNET.INBOUND_CONNECT_TIMEOUT parameters should be set to a value greater than 0.",
+      "description": "The INBOUND_CONNECT_TIMEOUT_[listener-name] and SQLNET.INBOUND_CONNECT_TIMEOUT defines the limit the database listener and database server respectively will wait for a client connection to complete after a connection request is made. This limit protects the listener and database server from a Denial-of-Service attack where multiple connection requests are made that are not used or closed from a client. Server resources can be exhausted if unused connections are maintained.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3863",
+      "title": "The Oracle SQLNET.EXPIRE_TIME parameter should be set to a value greater than 0.",
+      "description": "The SQLNET.EXPIRE_TIME parameter defines a limit for the frequency of active connection verification of a client connection. This prevents indefinite open connections to the database where client connections have not been terminated properly. Indefinite open connections could lead to an exhaustion of system resources or leave an open connection available for compromise.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-3866",
+      "title": "The Oracle Management Agent should be uninstalled if not required and authorized or is installed on a database accessible from the Internet.",
+      "description": "The Oracle Management Agent (Oracle Intelligent Agent in earlier versions) provides the mechanism for local and/or remote management of the local Oracle Database by Oracle Enterprise Manager or other SNMP management platforms. Because it provides access to operating system and database functions, it should be uninstalled if not in use.",
+      "severity": "low"
+    },
+    {
+      "id": "V-43137",
+      "title": "DBMS cryptography must be NIST FIPS 140-2 validated.",
+      "description": "Use of cryptography to provide confidentiality and non-repudiation is not effective unless strong methods are employed with its use. Many earlier encryption methods and modules have been broken and/or overtaken by increasing computing power. The NIST FIPS 140-2 cryptographic standards provide proven methods and strengths to employ cryptography effectively.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-4754",
+      "title": "Database software directories including DBMS configuration files are stored in dedicated directories separate from the host OS and other applications.",
+      "description": "Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directoriies both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application’s database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-5658",
+      "title": "Vendor supported software is evaluated and patched against newly found vulnerabilities.",
+      "description": "Unsupported software versions are not patched by vendors to address newly discovered security versions. An unpatched version is vulnerable to attack.",
+      "severity": "high"
+    },
+    {
+      "id": "V-5659",
+      "title": "The latest security patches should be installed.",
+      "description": "Maintaining the currency of the software version protects the database from known vulnerabilities.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-6756",
+      "title": "Only necessary privileges to the host system should be granted to DBA OS accounts.",
+      "description": "Database administration accounts are frequently granted more permissions to the local host system than are necessary. This allows inadvertent or malicious changes to the host operating system.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-6767",
+      "title": "The database should be secured in accordance with DoD guidance where applicable.",
+      "description": "DBMS systems that do not follow DoD security guidance are vulnerable to related published vulnerabilities. A DoD reference document such as a security technical implementation guide or security recommendation guide constitutes the primary source for security configuration or implementation guidance for the deployment of newly acquired IA- and IA-enabled IT products that require use of the product's IA capabilities. ",
+      "severity": "medium"
+    }
+  ]
+}