kriterion 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +2 -0
- data/.ruby-version +1 -0
- data/.travis.yml +5 -0
- data/Dockerfile +18 -0
- data/Gemfile +12 -0
- data/Gemfile.lock +62 -0
- data/LICENSE.txt +21 -0
- data/README.md +58 -0
- data/Rakefile +6 -0
- data/bin/setup +8 -0
- data/bin/update_stigs.rb +42 -0
- data/criterion.gemspec +31 -0
- data/docker-compose.yml +14 -0
- data/exe/kriterion +16 -0
- data/lib/kriterion.rb +16 -0
- data/lib/kriterion/api.rb +27 -0
- data/lib/kriterion/backend.rb +13 -0
- data/lib/kriterion/backend/mongodb.rb +235 -0
- data/lib/kriterion/cli.rb +28 -0
- data/lib/kriterion/cli/api.rb +35 -0
- data/lib/kriterion/cli/worker.rb +35 -0
- data/lib/kriterion/event.rb +36 -0
- data/lib/kriterion/item.rb +42 -0
- data/lib/kriterion/logs.rb +14 -0
- data/lib/kriterion/metrics.rb +22 -0
- data/lib/kriterion/object.rb +50 -0
- data/lib/kriterion/report.rb +69 -0
- data/lib/kriterion/resource.rb +60 -0
- data/lib/kriterion/section.rb +32 -0
- data/lib/kriterion/standard.rb +65 -0
- data/lib/kriterion/version.rb +3 -0
- data/lib/kriterion/worker.rb +280 -0
- data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
- data/standards/stig_a10_networks_adc_alg.json +209 -0
- data/standards/stig_a10_networks_adc_ndm.json +233 -0
- data/standards/stig_active_directory_domain.json +257 -0
- data/standards/stig_active_directory_forest.json +41 -0
- data/standards/stig_active_directory_service_2003.json +173 -0
- data/standards/stig_active_directory_service_2008.json +167 -0
- data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
- data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
- data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
- data/standards/stig_adobe_coldfusion_11.json +611 -0
- data/standards/stig_airwatch_mdm.json +185 -0
- data/standards/stig_aix_5.3.json +3095 -0
- data/standards/stig_aix_6.1.json +3047 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
- data/standards/stig_android_2.2_dell.json +311 -0
- data/standards/stig_apache_2.2_serverwindows.json +347 -0
- data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
- data/standards/stig_apache_server_2.0unix.json +341 -0
- data/standards/stig_apache_server_2.0windows.json +341 -0
- data/standards/stig_apache_server_2.2unix.json +347 -0
- data/standards/stig_apache_server_2.2windows.json +347 -0
- data/standards/stig_apache_site_2.0unix.json +185 -0
- data/standards/stig_apache_site_2.0windows.json +179 -0
- data/standards/stig_apache_site_2.2unix.json +185 -0
- data/standards/stig_apache_site_2.2windows.json +179 -0
- data/standards/stig_apple_ios6.json +341 -0
- data/standards/stig_apple_ios_10.json +245 -0
- data/standards/stig_apple_ios_11.json +269 -0
- data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
- data/standards/stig_apple_ios_5.json +329 -0
- data/standards/stig_apple_ios_6.json +335 -0
- data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
- data/standards/stig_apple_ios_7.json +185 -0
- data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
- data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
- data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
- data/standards/stig_apple_os_x_10.11.json +725 -0
- data/standards/stig_apple_os_x_10.12.json +737 -0
- data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
- data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
- data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
- data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
- data/standards/stig_application_security_and_development.json +1745 -0
- data/standards/stig_application_security_and_development_checklist.json +959 -0
- data/standards/stig_application_security_requirements_guide.json +1961 -0
- data/standards/stig_application_server_security_requirements_guide.json +791 -0
- data/standards/stig_arcgisserver_10.3.json +143 -0
- data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
- data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
- data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
- data/standards/stig_bind_9.x.json +431 -0
- data/standards/stig_bind_dns.json +317 -0
- data/standards/stig_blackberry_10.2.x_os.json +179 -0
- data/standards/stig_blackberry_10_os.json +227 -0
- data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
- data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
- data/standards/stig_blackberry_device_service_6.2.json +425 -0
- data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
- data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
- data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
- data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
- data/standards/stig_blackberry_handheld_device.json +125 -0
- data/standards/stig_blackberry_os_10.3.x.json +257 -0
- data/standards/stig_blackberry_os_7.x.json +107 -0
- data/standards/stig_blackberry_os_7.x.x.json +101 -0
- data/standards/stig_blackberry_os_version_5-7.json +107 -0
- data/standards/stig_blackberry_playbook.json +65 -0
- data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
- data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
- data/standards/stig_blackberry_uem_12.7.json +59 -0
- data/standards/stig_bluetoothzigbee.json +35 -0
- data/standards/stig_ca_api_gateway_alg.json +497 -0
- data/standards/stig_cisco_css_dns.json +71 -0
- data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
- data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
- data/standards/stig_cmd_management_server_policy.json +53 -0
- data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
- data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
- data/standards/stig_database_security_requirements_guide.json +767 -0
- data/standards/stig_dbn-6300_idps.json +107 -0
- data/standards/stig_dbn-6300_ndm.json +359 -0
- data/standards/stig_defense_switched_network.json +683 -0
- data/standards/stig_defense_switched_network_dsn.json +653 -0
- data/standards/stig_desktop_applications_general.json +41 -0
- data/standards/stig_dns_policy.json +155 -0
- data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
- data/standards/stig_draft_aix.json +3503 -0
- data/standards/stig_edb_postgres_advanced_server.json +665 -0
- data/standards/stig_email_services_policy.json +137 -0
- data/standards/stig_exchange_2010_client_access_server.json +179 -0
- data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
- data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
- data/standards/stig_exchange_2010_mailbox_server.json +209 -0
- data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
- data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
- data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
- data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
- data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
- data/standards/stig_final_draft_general_wireless_policy.json +71 -0
- data/standards/stig_firewall.json +449 -0
- data/standards/stig_firewall_-_cisco.json +449 -0
- data/standards/stig_firewall_security_requirements_guide.json +257 -0
- data/standards/stig_forescout_counteract_alg.json +83 -0
- data/standards/stig_forescout_counteract_ndm.json +239 -0
- data/standards/stig_free_space_optics_device.json +143 -0
- data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
- data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
- data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
- data/standards/stig_general_wireless_policy.json +71 -0
- data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
- data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
- data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
- data/standards/stig_goodenterprise_8.x.json +401 -0
- data/standards/stig_google_chrome_browser.json +209 -0
- data/standards/stig_google_chrome_current_windows.json +215 -0
- data/standards/stig_google_chrome_draft.json +281 -0
- data/standards/stig_google_chrome_v23_windows.json +275 -0
- data/standards/stig_google_chrome_v24_windows.json +263 -0
- data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
- data/standards/stig_google_search_appliance.json +209 -0
- data/standards/stig_harris_secnet_11_54.json +89 -0
- data/standards/stig_hp-ux_11.23.json +3215 -0
- data/standards/stig_hp-ux_11.31.json +3155 -0
- data/standards/stig_hp-ux_smse.json +431 -0
- data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
- data/standards/stig_ibm_datapower_alg.json +401 -0
- data/standards/stig_ibm_datapower_network_device_management.json +395 -0
- data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
- data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
- data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
- data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
- data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
- data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
- data/standards/stig_idsips.json +257 -0
- data/standards/stig_iis6_server.json +221 -0
- data/standards/stig_iis6_site.json +263 -0
- data/standards/stig_iis_7.0_web_server.json +155 -0
- data/standards/stig_iis_7.0_web_site.json +299 -0
- data/standards/stig_iis_8.5_server.json +293 -0
- data/standards/stig_iis_8.5_site.json +347 -0
- data/standards/stig_infoblox_7.x_dns.json +419 -0
- data/standards/stig_infrastructure_l3_switch.json +599 -0
- data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
- data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
- data/standards/stig_infrastructure_router.json +479 -0
- data/standards/stig_infrastructure_router_-_cisco.json +539 -0
- data/standards/stig_infrastructure_router_-_juniper.json +485 -0
- data/standards/stig_infrastructure_router__cisco.json +539 -0
- data/standards/stig_infrastructure_router__juniper.json +485 -0
- data/standards/stig_internet_explorer_8.json +821 -0
- data/standards/stig_internet_explorer_9.json +815 -0
- data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
- data/standards/stig_ipsec_vpn_gateway.json +521 -0
- data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
- data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
- data/standards/stig_jboss_eap_6.3.json +413 -0
- data/standards/stig_juniper_srx_sg_alg.json +155 -0
- data/standards/stig_juniper_srx_sg_idps.json +179 -0
- data/standards/stig_juniper_srx_sg_ndm.json +443 -0
- data/standards/stig_juniper_srx_sg_vpn.json +185 -0
- data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
- data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
- data/standards/stig_layer_2_switch.json +347 -0
- data/standards/stig_layer_2_switch_-_cisco.json +365 -0
- data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
- data/standards/stig_lg_android_6.x.json +281 -0
- data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
- data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
- data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
- data/standards/stig_mcafee_application_control_7.x.json +203 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
- data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
- data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
- data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
- data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
- data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
- data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
- data/standards/stig_mdm_server_policy.json +47 -0
- data/standards/stig_microsoft_access_2003.json +47 -0
- data/standards/stig_microsoft_access_2007.json +77 -0
- data/standards/stig_microsoft_access_2010.json +119 -0
- data/standards/stig_microsoft_access_2013.json +113 -0
- data/standards/stig_microsoft_access_2016.json +107 -0
- data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
- data/standards/stig_microsoft_excel_2003.json +47 -0
- data/standards/stig_microsoft_excel_2007.json +155 -0
- data/standards/stig_microsoft_excel_2010.json +287 -0
- data/standards/stig_microsoft_excel_2013.json +293 -0
- data/standards/stig_microsoft_excel_2016.json +257 -0
- data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
- data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
- data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
- data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
- data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
- data/standards/stig_microsoft_exchange_server_2003.json +647 -0
- data/standards/stig_microsoft_groove_2013.json +71 -0
- data/standards/stig_microsoft_ie_version_6.json +599 -0
- data/standards/stig_microsoft_ie_version_7.json +749 -0
- data/standards/stig_microsoft_infopath_2003.json +41 -0
- data/standards/stig_microsoft_infopath_2007.json +167 -0
- data/standards/stig_microsoft_infopath_2010.json +155 -0
- data/standards/stig_microsoft_infopath_2013.json +149 -0
- data/standards/stig_microsoft_internet_explorer_10.json +857 -0
- data/standards/stig_microsoft_internet_explorer_11.json +839 -0
- data/standards/stig_microsoft_internet_explorer_9.json +821 -0
- data/standards/stig_microsoft_lync_2013.json +29 -0
- data/standards/stig_microsoft_office_system_2007.json +221 -0
- data/standards/stig_microsoft_office_system_2010.json +233 -0
- data/standards/stig_microsoft_office_system_2013.json +293 -0
- data/standards/stig_microsoft_office_system_2016.json +131 -0
- data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
- data/standards/stig_microsoft_onenote_2010.json +77 -0
- data/standards/stig_microsoft_onenote_2013.json +71 -0
- data/standards/stig_microsoft_onenote_2016.json +71 -0
- data/standards/stig_microsoft_outlook_2003.json +65 -0
- data/standards/stig_microsoft_outlook_2007.json +479 -0
- data/standards/stig_microsoft_outlook_2010.json +515 -0
- data/standards/stig_microsoft_outlook_2013.json +497 -0
- data/standards/stig_microsoft_outlook_2016.json +359 -0
- data/standards/stig_microsoft_powerpoint_2003.json +47 -0
- data/standards/stig_microsoft_powerpoint_2007.json +131 -0
- data/standards/stig_microsoft_powerpoint_2010.json +191 -0
- data/standards/stig_microsoft_powerpoint_2013.json +251 -0
- data/standards/stig_microsoft_powerpoint_2016.json +233 -0
- data/standards/stig_microsoft_project_2010.json +83 -0
- data/standards/stig_microsoft_project_2013.json +95 -0
- data/standards/stig_microsoft_project_2016.json +95 -0
- data/standards/stig_microsoft_publisher_2010.json +107 -0
- data/standards/stig_microsoft_publisher_2013.json +101 -0
- data/standards/stig_microsoft_publisher_2016.json +101 -0
- data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
- data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
- data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
- data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
- data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
- data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
- data/standards/stig_microsoft_visio_2013.json +89 -0
- data/standards/stig_microsoft_visio_2016.json +89 -0
- data/standards/stig_microsoft_windows_10_mobile.json +215 -0
- data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
- data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
- data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
- data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
- data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
- data/standards/stig_microsoft_word_2003.json +47 -0
- data/standards/stig_microsoft_word_2007.json +119 -0
- data/standards/stig_microsoft_word_2010.json +221 -0
- data/standards/stig_microsoft_word_2013.json +221 -0
- data/standards/stig_microsoft_word_2016.json +215 -0
- data/standards/stig_mobile_application_management_mam_server.json +95 -0
- data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
- data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
- data/standards/stig_mobile_device_management_mdm_server.json +125 -0
- data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
- data/standards/stig_mobile_email_management_mem_server.json +197 -0
- data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
- data/standards/stig_mobile_policy.json +35 -0
- data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
- data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
- data/standards/stig_mobility_policy.json +65 -0
- data/standards/stig_mozilla_firefox.json +161 -0
- data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
- data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
- data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
- data/standards/stig_ms_sharepoint_2010.json +269 -0
- data/standards/stig_ms_sharepoint_2013.json +245 -0
- data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
- data/standards/stig_ms_sql_server_2014_database.json +263 -0
- data/standards/stig_ms_sql_server_2014_instance.json +575 -0
- data/standards/stig_ms_sql_server_2016_database.json +185 -0
- data/standards/stig_ms_sql_server_2016_instance.json +731 -0
- data/standards/stig_ms_windows_defender_antivirus.json +257 -0
- data/standards/stig_multifunction_device_and_network_printers.json +131 -0
- data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
- data/standards/stig_network_devices.json +389 -0
- data/standards/stig_network_infrastructure_policy.json +455 -0
- data/standards/stig_network_security_requirements_guide.json +1961 -0
- data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
- data/standards/stig_oracle_10_database_installation.json +527 -0
- data/standards/stig_oracle_10_database_instance.json +569 -0
- data/standards/stig_oracle_11_database_installation.json +527 -0
- data/standards/stig_oracle_11_database_instance.json +551 -0
- data/standards/stig_oracle_database_10g_installation.json +527 -0
- data/standards/stig_oracle_database_10g_instance.json +581 -0
- data/standards/stig_oracle_database_11.2g.json +1229 -0
- data/standards/stig_oracle_database_11g_installation.json +527 -0
- data/standards/stig_oracle_database_11g_instance.json +575 -0
- data/standards/stig_oracle_database_12c.json +1217 -0
- data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
- data/standards/stig_oracle_linux_5.json +3431 -0
- data/standards/stig_oracle_linux_6.json +1583 -0
- data/standards/stig_oracle_weblogic_server_12c.json +443 -0
- data/standards/stig_palo_alto_networks_alg.json +311 -0
- data/standards/stig_palo_alto_networks_idps.json +185 -0
- data/standards/stig_palo_alto_networks_ndm.json +251 -0
- data/standards/stig_pda.json +83 -0
- data/standards/stig_pdasmartphone.json +95 -0
- data/standards/stig_perimeter_l3_switch.json +923 -0
- data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
- data/standards/stig_perimeter_router.json +803 -0
- data/standards/stig_perimeter_router_cisco.json +881 -0
- data/standards/stig_perimeter_router_juniper.json +803 -0
- data/standards/stig_postgresql_9.x.json +677 -0
- data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
- data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
- data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
- data/standards/stig_remote_access_policy.json +317 -0
- data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
- data/standards/stig_removable_storage_and_external_connections.json +137 -0
- data/standards/stig_rfid_scanner.json +35 -0
- data/standards/stig_rfid_workstation.json +23 -0
- data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
- data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
- data/standards/stig_router_security_requirements_guide.json +575 -0
- data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
- data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
- data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
- data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
- data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
- data/standards/stig_samsung_knox_android_1.0.json +167 -0
- data/standards/stig_sharepoint_2010.json +269 -0
- data/standards/stig_sharepoint_2013.json +245 -0
- data/standards/stig_smartphone_policy.json +131 -0
- data/standards/stig_solaris_10_sparc.json +3029 -0
- data/standards/stig_solaris_10_x86.json +3065 -0
- data/standards/stig_solaris_11_sparc.json +1427 -0
- data/standards/stig_solaris_11_x86.json +1421 -0
- data/standards/stig_solaris_9_sparc.json +2915 -0
- data/standards/stig_solaris_9_x86.json +2915 -0
- data/standards/stig_sun_ray_4.json +185 -0
- data/standards/stig_sun_ray_4_policy.json +77 -0
- data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
- data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
- data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
- data/standards/stig_tanium_6.5.json +461 -0
- data/standards/stig_tanium_7.0.json +803 -0
- data/standards/stig_test_and_development_zone_a.json +167 -0
- data/standards/stig_test_and_development_zone_b.json +179 -0
- data/standards/stig_test_and_development_zone_c.json +143 -0
- data/standards/stig_test_and_development_zone_d.json +143 -0
- data/standards/stig_traditional_security.json +917 -0
- data/standards/stig_unix_srg.json +3287 -0
- data/standards/stig_video_services_policy.json +497 -0
- data/standards/stig_video_teleconference.json +47 -0
- data/standards/stig_video_teleconference_vtc.json +12 -0
- data/standards/stig_vmware_esx_3_policy.json +155 -0
- data/standards/stig_vmware_esx_3_server.json +3791 -0
- data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
- data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
- data/standards/stig_vmware_esxi_server_5.0.json +809 -0
- data/standards/stig_vmware_esxi_v5.json +5177 -0
- data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
- data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
- data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
- data/standards/stig_vmware_nsx_manager.json +191 -0
- data/standards/stig_vmware_vcenter_server.json +179 -0
- data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
- data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
- data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
- data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
- data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
- data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
- data/standards/stig_voice_video_services_policy.json +671 -0
- data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
- data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
- data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
- data/standards/stig_voicevideo_services_policy.json +569 -0
- data/standards/stig_web_policy.json +95 -0
- data/standards/stig_web_server.json +317 -0
- data/standards/stig_web_server_security_requirements_guide.json +587 -0
- data/standards/stig_win2k3_audit.json +761 -0
- data/standards/stig_win2k8_audit.json +1085 -0
- data/standards/stig_win2k8_r2_audit.json +1637 -0
- data/standards/stig_win7_audit.json +1613 -0
- data/standards/stig_windows_10.json +1691 -0
- data/standards/stig_windows_2003_domain_controller.json +893 -0
- data/standards/stig_windows_2003_member_server.json +845 -0
- data/standards/stig_windows_2008_domain_controller.json +1475 -0
- data/standards/stig_windows_2008_member_server.json +1301 -0
- data/standards/stig_windows_7.json +1781 -0
- data/standards/stig_windows_8.json +2399 -0
- data/standards/stig_windows_88.1.json +2273 -0
- data/standards/stig_windows_8_8.1.json +2297 -0
- data/standards/stig_windows_defender_antivirus.json +239 -0
- data/standards/stig_windows_dns.json +185 -0
- data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
- data/standards/stig_windows_paw.json +155 -0
- data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
- data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
- data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
- data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
- data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
- data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
- data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
- data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
- data/standards/stig_windows_server_2012_member_server.json +2249 -0
- data/standards/stig_windows_server_2016.json +1661 -0
- data/standards/stig_windows_vista.json +1517 -0
- data/standards/stig_windows_xp.json +893 -0
- data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
- data/standards/stig_wireless_management_server_policy.json +53 -0
- data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
- data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
- data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
- data/standards/stig_wlan_access_point_policy.json +17 -0
- data/standards/stig_wlan_authentication_server.json +29 -0
- data/standards/stig_wlan_bridge.json +209 -0
- data/standards/stig_wlan_client.json +65 -0
- data/standards/stig_wlan_controller.json +215 -0
- data/standards/stig_wlan_ids_sensorserver.json +23 -0
- data/standards/stig_wman_access_point.json +263 -0
- data/standards/stig_wman_bridge.json +209 -0
- data/standards/stig_wman_subscriber.json +65 -0
- data/standards/stig_zos_acf2.json +1451 -0
- data/standards/stig_zos_bmc_control-dacf2.json +53 -0
- data/standards/stig_zos_bmc_control-dracf.json +59 -0
- data/standards/stig_zos_bmc_control-dtss.json +65 -0
- data/standards/stig_zos_bmc_control-macf2.json +59 -0
- data/standards/stig_zos_bmc_control-mracf.json +65 -0
- data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
- data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
- data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
- data/standards/stig_zos_bmc_control-mtss.json +71 -0
- data/standards/stig_zos_bmc_control-oacf2.json +53 -0
- data/standards/stig_zos_bmc_control-oracf.json +59 -0
- data/standards/stig_zos_bmc_control-otss.json +65 -0
- data/standards/stig_zos_bmc_ioaacf2.json +53 -0
- data/standards/stig_zos_bmc_ioaracf.json +59 -0
- data/standards/stig_zos_bmc_ioatss.json +65 -0
- data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
- data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
- data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
- data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
- data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
- data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
- data/standards/stig_zos_ca_auditoracf2.json +29 -0
- data/standards/stig_zos_ca_auditorracf.json +29 -0
- data/standards/stig_zos_ca_auditortss.json +29 -0
- data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
- data/standards/stig_zos_ca_common_servicesracf.json +29 -0
- data/standards/stig_zos_ca_common_servicestss.json +29 -0
- data/standards/stig_zos_ca_micsacf2.json +23 -0
- data/standards/stig_zos_ca_micsracf.json +23 -0
- data/standards/stig_zos_ca_micstss.json +23 -0
- data/standards/stig_zos_ca_mimacf2.json +41 -0
- data/standards/stig_zos_ca_mimracf.json +47 -0
- data/standards/stig_zos_ca_mimtss.json +47 -0
- data/standards/stig_zos_ca_vtapeacf2.json +29 -0
- data/standards/stig_zos_ca_vtaperacf.json +35 -0
- data/standards/stig_zos_ca_vtapetss.json +35 -0
- data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
- data/standards/stig_zos_catalog_solutionsracf.json +23 -0
- data/standards/stig_zos_catalog_solutionstss.json +23 -0
- data/standards/stig_zos_clsupersessionacf2.json +53 -0
- data/standards/stig_zos_clsupersessionracf.json +65 -0
- data/standards/stig_zos_clsupersessiontss.json +71 -0
- data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
- data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
- data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
- data/standards/stig_zos_cssmtpacf2.json +23 -0
- data/standards/stig_zos_cssmtpracf.json +29 -0
- data/standards/stig_zos_cssmtptss.json +29 -0
- data/standards/stig_zos_fdracf2.json +23 -0
- data/standards/stig_zos_fdrracf.json +23 -0
- data/standards/stig_zos_fdrtss.json +23 -0
- data/standards/stig_zos_hcdacf2.json +29 -0
- data/standards/stig_zos_hcdracf.json +29 -0
- data/standards/stig_zos_hcdtss.json +29 -0
- data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
- data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
- data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
- data/standards/stig_zos_ibm_health_checkertss.json +29 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
- data/standards/stig_zos_icsfacf2.json +29 -0
- data/standards/stig_zos_icsfracf.json +35 -0
- data/standards/stig_zos_icsftss.json +35 -0
- data/standards/stig_zos_netviewacf2.json +41 -0
- data/standards/stig_zos_netviewracf.json +47 -0
- data/standards/stig_zos_netviewtss.json +53 -0
- data/standards/stig_zos_quest_nc-passacf2.json +35 -0
- data/standards/stig_zos_quest_nc-passracf.json +41 -0
- data/standards/stig_zos_quest_nc-passtss.json +47 -0
- data/standards/stig_zos_racf.json +1415 -0
- data/standards/stig_zos_roscoeacf2.json +47 -0
- data/standards/stig_zos_roscoeracf.json +53 -0
- data/standards/stig_zos_roscoetss.json +59 -0
- data/standards/stig_zos_srrauditacf2.json +23 -0
- data/standards/stig_zos_srrauditracf.json +23 -0
- data/standards/stig_zos_srraudittss.json +23 -0
- data/standards/stig_zos_tadzacf2.json +29 -0
- data/standards/stig_zos_tadzracf.json +35 -0
- data/standards/stig_zos_tadztss.json +35 -0
- data/standards/stig_zos_tdmfacf2.json +23 -0
- data/standards/stig_zos_tdmfracf.json +23 -0
- data/standards/stig_zos_tdmftss.json +23 -0
- data/standards/stig_zos_tss.json +1523 -0
- data/standards/stig_zos_vssracf.json +29 -0
- metadata +691 -0
|
@@ -0,0 +1,1241 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_apple_os_x_10.8_mountain_lion_workstation",
|
|
3
|
+
"date": "2015-02-10",
|
|
4
|
+
"description": "The Apple OS X 10.8 (Mountain Lion) Workstation Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.",
|
|
5
|
+
"title": "Apple OS X 10.8 (Mountain Lion) Workstation STIG",
|
|
6
|
+
"version": "1",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-51195",
|
|
12
|
+
"title": "The operating system must automatically terminate temporary accounts after an organization-defined time period for each type of account.",
|
|
13
|
+
"description": "When temporary and emergency accounts are created, there is a risk the temporary account may remain in place and active after the need for the account no longer exists.\n\nTo address this, in the event temporary accounts are required, accounts designated as temporary in nature must be automatically terminated after an organization-defined time period. Such a process and capability greatly reduces the risk of accounts being misused, hijacked, or data compromised.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-51231",
|
|
18
|
+
"title": "The login window must be configured to prompt for username and password, rather than show a list of users.",
|
|
19
|
+
"description": "The login window must be configured to prompt for username and password, rather than show a list of users.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-51233",
|
|
24
|
+
"title": "The ability for administrative accounts to unlock Screen Saver must be disabled.",
|
|
25
|
+
"description": "The ability for administrative accounts to unlock Screen Saver must be disabled.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-51235",
|
|
30
|
+
"title": "All core system files must have the correct permissions, ownership, and group-ownership assigned as originally installed.",
|
|
31
|
+
"description": "All core system files should have the correct permissions, ownership, and group-ownership assigned as originally installed.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-51237",
|
|
36
|
+
"title": "User home directories must not have extended ACLs.",
|
|
37
|
+
"description": "User home directories must not have extended ACLs.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-51239",
|
|
42
|
+
"title": "Device files and directories must only be writable by users with a system account or as configured by the vendor.",
|
|
43
|
+
"description": "Device files and directories must only be writable by users with a system account or as configured by the vendor.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-51241",
|
|
48
|
+
"title": "The sudoers file must be configured to authenticate users on a per-tty basis.",
|
|
49
|
+
"description": "Do not allow direct root login because the logs cannot identify which administrator logged in. Instead, log in using accounts with administrator privileges, and then use the sudo command to perform actions as root. This limits authorization to the terminal in which authentication occurred.",
|
|
50
|
+
"severity": "high"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-51243",
|
|
54
|
+
"title": "The sudoers file must be configured to require authentication on every use.",
|
|
55
|
+
"description": "Do not allow direct root login because the logs cannot identify which administrator logged in. Instead, log in using accounts with administrator privileges, and then use the sudo command to perform actions as root. This limits the use of the sudo command to a single command per authentication.",
|
|
56
|
+
"severity": "high"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-51245",
|
|
60
|
+
"title": "All files and directories contained in user home directories must be group-owned by a group of which the home directorys owner is a member.",
|
|
61
|
+
"description": "All files and directories contained in user home directories must be group-owned by a group of which the home directory's owner is a member. Check the contents of user home directories for files group-owned by a group where the home directory's owner is not a member.",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-51247",
|
|
66
|
+
"title": "All files and directories contained in interactive user home directories must be owned by the home directorys owner.",
|
|
67
|
+
"description": "All files and directories contained in interactive user home directories must be owned by the home directory's owner.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-51249",
|
|
72
|
+
"title": "The default global umask setting must be changed for user applications.",
|
|
73
|
+
"description": "The default global umask setting must be changed for user applications.",
|
|
74
|
+
"severity": "medium"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-51251",
|
|
78
|
+
"title": "The default global umask setting must be changed for system processes.",
|
|
79
|
+
"description": "The default global umask setting must be configured correctly for system processes.",
|
|
80
|
+
"severity": "medium"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-51253",
|
|
84
|
+
"title": "Local logging must be enabled.",
|
|
85
|
+
"description": "Local logging must be enabled.",
|
|
86
|
+
"severity": "medium"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-51255",
|
|
90
|
+
"title": "Newsyslog must be correctly configured to rotate log files.",
|
|
91
|
+
"description": "Newsyslog needs to be correctly configured to rotate log files.",
|
|
92
|
+
"severity": "medium"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-51257",
|
|
96
|
+
"title": "Administrator accounts must be created with difficult-to-guess names.",
|
|
97
|
+
"description": "Administrator accounts must be created with difficult-to-guess names.",
|
|
98
|
+
"severity": "medium"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-51259",
|
|
102
|
+
"title": "The system must not use .forward files.",
|
|
103
|
+
"description": "The system must not use .forward files.",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-51261",
|
|
108
|
+
"title": "Active Directory Access must be securely configured to sign all packets.",
|
|
109
|
+
"description": "Active Directory Access must be securely configured to sign all packets.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-51263",
|
|
114
|
+
"title": "Active Directory Access must be securely configured to encrypt all packets.",
|
|
115
|
+
"description": "Active Directory Access must be securely configured to encrypt all packets.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-51265",
|
|
120
|
+
"title": "iTunes Store must be disabled.",
|
|
121
|
+
"description": "iTunes Store must be disabled.",
|
|
122
|
+
"severity": "low"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-51267",
|
|
126
|
+
"title": "An Emergency Administrator Account must be created.",
|
|
127
|
+
"description": "An Emergency Administrator Account must be created. Interview the SA to determine if an emergency administrator account exists and is stored with its password in a secure location. This emergency account should have a UID less than \"500\", and be hidden from view.",
|
|
128
|
+
"severity": "medium"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-51269",
|
|
132
|
+
"title": "The root account must be the only account having a UID of 0.",
|
|
133
|
+
"description": "The root account must be the only account having a UID of \"0\".",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-51271",
|
|
138
|
+
"title": "Finder must be set to always empty Trash securely.",
|
|
139
|
+
"description": "Finder must be set to always empty Trash securely. In Mac OS X Finder can be configured to always securely erase items placed in the Trash. This prevents data placed in the Trash from being restored.",
|
|
140
|
+
"severity": "low"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-51273",
|
|
144
|
+
"title": "The application firewall must be enabled.",
|
|
145
|
+
"description": "The application firewall must be enabled.",
|
|
146
|
+
"severity": "medium"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-51275",
|
|
150
|
+
"title": "The system must not be allowed to restart after a power failure.",
|
|
151
|
+
"description": "The system must not be allowed to restart after a power failure.",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "V-51277",
|
|
156
|
+
"title": "Fast User Switching must be disabled.",
|
|
157
|
+
"description": "Fast User Switching must be disabled.",
|
|
158
|
+
"severity": "medium"
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "V-51279",
|
|
162
|
+
"title": "Kernel core dumps must be disabled unless needed.",
|
|
163
|
+
"description": "Kernel core dumps must be disabled unless needed.",
|
|
164
|
+
"severity": "medium"
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "V-51281",
|
|
168
|
+
"title": "All public directories must be owned by root or an application account.",
|
|
169
|
+
"description": "All public directories must be owned by root or an application account.",
|
|
170
|
+
"severity": "medium"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"id": "V-51283",
|
|
174
|
+
"title": "The system must not have the finger service active.",
|
|
175
|
+
"description": "The system must not have the finger service active.",
|
|
176
|
+
"severity": "medium"
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"id": "V-51285",
|
|
180
|
+
"title": "The sticky bit must be set on all public directories.",
|
|
181
|
+
"description": "The sticky bit must be set on all public directories.",
|
|
182
|
+
"severity": "medium"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "V-51287",
|
|
186
|
+
"title": "The prompt for Apple ID and iCloud must be disabled.",
|
|
187
|
+
"description": "The prompt for Apple ID and iCloud must be disabled.",
|
|
188
|
+
"severity": "medium"
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "V-51289",
|
|
192
|
+
"title": "Users must not have Apple IDs signed into iCloud.",
|
|
193
|
+
"description": "Users should not have Apple ID's signed into iCloud.",
|
|
194
|
+
"severity": "medium"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "V-51291",
|
|
198
|
+
"title": "Spotlight Panel must be securely configured.",
|
|
199
|
+
"description": "Spotlight Panel must be securely configured.",
|
|
200
|
+
"severity": "low"
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "V-51293",
|
|
204
|
+
"title": "iTunes Music Sharing must be disabled.",
|
|
205
|
+
"description": "iTunes Music Sharing must be disabled.",
|
|
206
|
+
"severity": "low"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "V-51295",
|
|
210
|
+
"title": "All setuid executables on the system must be vendor-supplied.",
|
|
211
|
+
"description": "All files with the setuid bit set will allow anyone running these files to be temporarily assigned the UID of the file. While many system files depend on these attributes for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes. Only default vendor-supplied executables should have the setuid bit set.",
|
|
212
|
+
"severity": "medium"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "V-51297",
|
|
216
|
+
"title": "iTunes Radio must be disabled.",
|
|
217
|
+
"description": "iTunes Radio must be disabled.",
|
|
218
|
+
"severity": "low"
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
"id": "V-51299",
|
|
222
|
+
"title": "iTunes Podcasts must be disabled.",
|
|
223
|
+
"description": "iTunes Podcasts must be disabled.",
|
|
224
|
+
"severity": "low"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"id": "V-51301",
|
|
228
|
+
"title": "Unnecessary packages must not be installed.",
|
|
229
|
+
"description": "Unnecessary packages must not be installed.",
|
|
230
|
+
"severity": "medium"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"id": "V-51303",
|
|
234
|
+
"title": "The centralized process core dump data directory must be owned by root.",
|
|
235
|
+
"description": "The centralized process core dump data directory must be owned by root.",
|
|
236
|
+
"severity": "medium"
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
"id": "V-51305",
|
|
240
|
+
"title": "The centralized process core dump data directory must have mode 0750 or less permissive.",
|
|
241
|
+
"description": "The centralized process core dump data directory must have mode \"0750' or less permissive.",
|
|
242
|
+
"severity": "medium"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "V-51307",
|
|
246
|
+
"title": "The centralized process core dump data directory must be group-owned by admin.",
|
|
247
|
+
"description": "The centralized process core dump data directory must be group-owned by admin.",
|
|
248
|
+
"severity": "medium"
|
|
249
|
+
},
|
|
250
|
+
{
|
|
251
|
+
"id": "V-51309",
|
|
252
|
+
"title": "The system must not respond to Internet Control Message Protocol [ICMPv4] echoes sent to a broadcast address.",
|
|
253
|
+
"description": "The system must not respond to Internet Control Message Protocol [ICMPv4] echoes sent to a broadcast address.",
|
|
254
|
+
"severity": "medium"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"id": "V-51311",
|
|
258
|
+
"title": "The system must not accept source-routed IPv4 packets.",
|
|
259
|
+
"description": "The system must not accept source-routed IPv4 packets.",
|
|
260
|
+
"severity": "medium"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"id": "V-51313",
|
|
264
|
+
"title": "The system must ignore IPv4 ICMP redirect messages.",
|
|
265
|
+
"description": "The system must ignore IPv4 ICMP redirect messages.",
|
|
266
|
+
"severity": "medium"
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"id": "V-51315",
|
|
270
|
+
"title": "IP forwarding for IPv4 must not be enabled, unless the system is a router.",
|
|
271
|
+
"description": "IP forwarding for IPv4 must not be enabled, unless the system is a router.",
|
|
272
|
+
"severity": "medium"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "V-51317",
|
|
276
|
+
"title": "The system must not send IPv4 ICMP redirects by default.",
|
|
277
|
+
"description": "The system must not send IPv4 ICMP redirects by default.",
|
|
278
|
+
"severity": "medium"
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
"id": "V-51319",
|
|
282
|
+
"title": "The system must prevent local applications from generating source-routed packets.",
|
|
283
|
+
"description": "The system must prevent local applications from generating source-routed packets.",
|
|
284
|
+
"severity": "medium"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"id": "V-51321",
|
|
288
|
+
"title": "The system must not process Internet Control Message Protocol [ICMP] timestamp requests.",
|
|
289
|
+
"description": "The system must not process Internet Control Message Protocol [ICMP] timestamp requests.",
|
|
290
|
+
"severity": "medium"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"id": "V-51323",
|
|
294
|
+
"title": "Audio recording support software must be disabled.",
|
|
295
|
+
"description": "Audio recording support software must be disabled.",
|
|
296
|
+
"severity": "medium"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"id": "V-51325",
|
|
300
|
+
"title": "Unused network devices must be disabled.",
|
|
301
|
+
"description": "Unused network devices must be disabled.",
|
|
302
|
+
"severity": "medium"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "V-51327",
|
|
306
|
+
"title": "Stealth Mode must be enabled on the firewall.",
|
|
307
|
+
"description": "Stealth Mode must be enabled on the firewall.",
|
|
308
|
+
"severity": "medium"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"id": "V-51329",
|
|
312
|
+
"title": "Secure virtual memory must be used.",
|
|
313
|
+
"description": "Secure virtual memory must be used.",
|
|
314
|
+
"severity": "medium"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"id": "V-51331",
|
|
318
|
+
"title": "The Operating System must be current and at the latest release level.",
|
|
319
|
+
"description": "The Operating System must be current and at the latest release level. If an OS is at an unsupported release level, this will be upgraded to a Category I finding since new vulnerabilities may not be patched.",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "V-51333",
|
|
324
|
+
"title": "The CRLStyle option must be set correctly.",
|
|
325
|
+
"description": "A trust anchor is an authoritative entity represented via a public key and associated data. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor, for example, a Certification Authority (CA). A certification path starts with the Subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nPath validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted. \n\nStatus information for certification paths includes, certificate revocation lists or online certificate status protocol responses.",
|
|
326
|
+
"severity": "medium"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"id": "V-51339",
|
|
330
|
+
"title": "A host-based firewall must be installed.",
|
|
331
|
+
"description": "Access into an organization's internal network and to key internal boundaries must be tightly controlled and managed. In the case of the operating system, the key boundary may be the workstation on the public internet.",
|
|
332
|
+
"severity": "medium"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "V-51341",
|
|
336
|
+
"title": "System Preferences must be securely configured so IPv6 is turned off if not being used.",
|
|
337
|
+
"description": "System Preferences must be securely configured so IPv6 is turned off if not being used.",
|
|
338
|
+
"severity": "medium"
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"id": "V-51343",
|
|
342
|
+
"title": "DoD proxies must be configured on all active network interfaces.",
|
|
343
|
+
"description": "A proxy server is designed to hide the identity of the client when making a connection to a server on the outside of its network. This prevents any hackers on the outside of learning IP addresses within the private network. With a proxy acting as the mediator, the client does not interact directly with the servers it is connecting to; the proxy server is in the middle handling both sides of the session.",
|
|
344
|
+
"severity": "medium"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"id": "V-51347",
|
|
348
|
+
"title": "The SSH daemon ClientAliveInterval option must be set correctly.",
|
|
349
|
+
"description": "This requirement applies to both internal and external networks. \n\nTerminating network connections associated with communications sessions means de-allocating associated TCP/IP address/port pairs at the operating system level.\n\nThe time period of inactivity may, as the organization deems necessary, be a set of time periods by type of network access or for specific accesses.",
|
|
350
|
+
"severity": "medium"
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
"id": "V-51351",
|
|
354
|
+
"title": "The SSH daemon ClientAliveCountMax option must be set correctly.",
|
|
355
|
+
"description": "This requirement applies to both internal and external networks. \n\nTerminating network connections associated with communications sessions means de-allocating associated TCP/IP address/port pairs at the operating system level.\n\nThe time period of inactivity may, as the organization deems necessary, be a set of time periods by type of network access or for specific accesses.",
|
|
356
|
+
"severity": "medium"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "V-51353",
|
|
360
|
+
"title": "The SSH daemon LoginGraceTime must be set correctly.",
|
|
361
|
+
"description": "LoginGraceTime must be securely configured in /etc/sshd_config.",
|
|
362
|
+
"severity": "low"
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"id": "V-51355",
|
|
366
|
+
"title": "The FIPS administrative and cryptographic modules must be installed correctly.",
|
|
367
|
+
"description": "Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. \n\nUse of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.",
|
|
368
|
+
"severity": "high"
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "V-51359",
|
|
372
|
+
"title": "Video recording support software must be disabled.",
|
|
373
|
+
"description": "Video recording support software must be disabled.",
|
|
374
|
+
"severity": "medium"
|
|
375
|
+
},
|
|
376
|
+
{
|
|
377
|
+
"id": "V-51365",
|
|
378
|
+
"title": "The operating system must issue or obtain public key certificates under an appropriate certificate policy from an approved service provider.",
|
|
379
|
+
"description": "For user certificates, each organization attains certificates from an approved, shared service provider, as required by OMB policy. \n\nFor federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority will suffice. \n\nThis control focuses on certificates with a visibility external to the information system and does not include certificates related to internal system operations, for example, application-specific time services.",
|
|
380
|
+
"severity": "medium"
|
|
381
|
+
},
|
|
382
|
+
{
|
|
383
|
+
"id": "V-51367",
|
|
384
|
+
"title": "The operating system must implement detection and inspection mechanisms to identify unauthorized mobile code.",
|
|
385
|
+
"description": "Decisions regarding the employment of mobile code within organizational information systems are based on the potential for the code to cause damage to the system if used maliciously. \n\nMobile code technologies include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. Usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations. \n\nXprotect Update needs to be running.",
|
|
386
|
+
"severity": "medium"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "V-51371",
|
|
390
|
+
"title": "The operating system must protect the confidentiality and integrity of information at rest.",
|
|
391
|
+
"description": "This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive). The operating system must ensure the data being written to these devices is protected. In most cases, this is done via encryption.",
|
|
392
|
+
"severity": "medium"
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
"id": "V-51373",
|
|
396
|
+
"title": "The operating system must employ automated mechanisms or must have an application installed that on an organization-defined frequency determines the state of information system components with regard to flaw remediation.",
|
|
397
|
+
"description": "Organizations are required to identify information systems containing software affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) and report this information to designated organizational officials with information security responsibilities (e.g., senior information security officers, information system security managers, information systems security officers). To support this requirement, an automated process or mechanism is required. \n\nThis role is usually assigned to patch management software deployed in order to track the number of systems installed in the network, as well as, the types of software installed on these systems, the corresponding versions and the related flaws that require patching. \n\nFrom an operating system requirement perspective, the operating system must perform this or there must be an application installed performing this function.",
|
|
398
|
+
"severity": "medium"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "V-51377",
|
|
402
|
+
"title": "The operating system must support automated patch management tools to facilitate flaw remediation to organization-defined information system components.",
|
|
403
|
+
"description": "The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling, must also be addressed.",
|
|
404
|
+
"severity": "medium"
|
|
405
|
+
},
|
|
406
|
+
{
|
|
407
|
+
"id": "V-51381",
|
|
408
|
+
"title": "System log files must be owned by root:wheel.",
|
|
409
|
+
"description": "If the operating system provides too much information in error logs and administrative messages to the screen it could lead to compromise. The structure and content of error messages need to be carefully considered by the organization.",
|
|
410
|
+
"severity": "medium"
|
|
411
|
+
},
|
|
412
|
+
{
|
|
413
|
+
"id": "V-51385",
|
|
414
|
+
"title": "System log files must have the correct permissions.",
|
|
415
|
+
"description": "System log files should have the correct permissions.",
|
|
416
|
+
"severity": "medium"
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
"id": "V-51387",
|
|
420
|
+
"title": "System log files must not contain ACLs.",
|
|
421
|
+
"description": "System log files should not contain ACLs.",
|
|
422
|
+
"severity": "medium"
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
"id": "V-51389",
|
|
426
|
+
"title": "The operating system must employ automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.",
|
|
427
|
+
"description": "Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. \n\nAutomated alarming mechanisms provide the appropriate personnel with the capability to immediately respond and react to events categorized as unusual or having security implications that could be detrimental to system and/or organizational security.",
|
|
428
|
+
"severity": "medium"
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "V-51393",
|
|
432
|
+
"title": "The operating system must back up audit records on an organization-defined frequency onto a different system or media than the system being audited.",
|
|
433
|
+
"description": "Protection of log data includes assuring the log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained.",
|
|
434
|
+
"severity": "medium"
|
|
435
|
+
},
|
|
436
|
+
{
|
|
437
|
+
"id": "V-51395",
|
|
438
|
+
"title": "The operating system for publicly accessible systems must display the system use information when appropriate, before granting further access.",
|
|
439
|
+
"description": "Requirement applies to publicly accessible systems. System use notification messages can be implemented in the form of warning banners displayed when individuals log in to the information system. System use notification is intended only for information system access including an interactive login interface with a human user and is not intended to require notification when an interactive interface does not exist.",
|
|
440
|
+
"severity": "medium"
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"id": "V-51397",
|
|
444
|
+
"title": "The operating system must employ automated mechanisms to centrally manage configuration settings.",
|
|
445
|
+
"description": "Configuration settings are the configurable security-related parameters of information technology products that are part of the information system. Security-related parameters are those parameters impacting the security state of the system including parameters related to meeting other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory settings (i.e., permissions); and settings for services, ports, protocols, and remote connections. Rather than visiting each system when making configuration changes, organizations must employ automated tools that can make changes across all systems. This greatly increases efficiency and manageability of applications in a large scale environment.",
|
|
446
|
+
"severity": "medium"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "V-51399",
|
|
450
|
+
"title": "The operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.",
|
|
451
|
+
"description": "This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system.",
|
|
452
|
+
"severity": "medium"
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"id": "V-51401",
|
|
456
|
+
"title": "The operating system must enforce requirements for remote connections to the information system.",
|
|
457
|
+
"description": "The organization will define the requirements for connection of remote connections. In order to ensure the connection provides adequate integrity and confidentiality of the connection, the operating system must enforce these requirements.",
|
|
458
|
+
"severity": "medium"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "V-51403",
|
|
462
|
+
"title": "The operating system must enforce requirements for remote connections to the information system.",
|
|
463
|
+
"description": "Screen Sharing must be disabled.",
|
|
464
|
+
"severity": "medium"
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "V-51405",
|
|
468
|
+
"title": "The operating system must automatically audit account modification.",
|
|
469
|
+
"description": "Once an attacker establishes initial access to a system, they often attempt to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply modify an existing account. \n\nAuditing of account modification is one method and best practice for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the modification of user accounts and, as required, notifies appropriate individuals.",
|
|
470
|
+
"severity": "medium"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"id": "V-51407",
|
|
474
|
+
"title": "The operating system must automatically audit account disabling actions.",
|
|
475
|
+
"description": "When accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying processes themselves. In order to detect and respond to events affecting user accessibility and operating system processing, the operating system must audit account disabling actions and, as required, notify the appropriate individuals, so they can investigate the event. Such a capability greatly reduces the risk that accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.",
|
|
476
|
+
"severity": "medium"
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"id": "V-51409",
|
|
480
|
+
"title": "The operating system must automatically audit account termination.",
|
|
481
|
+
"description": "Accounts are utilized for identifying individual application users or for identifying the application processes themselves. When accounts are deleted, a Denial of Service could happen. The operating system must audit and notify, as required, to mitigate the Denial of Service risk.",
|
|
482
|
+
"severity": "medium"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "V-51411",
|
|
486
|
+
"title": "The system firewall must be configured with a default-deny policy.",
|
|
487
|
+
"description": "Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to the information. \nInformation flow control policies and enforcement mechanisms are commonly employed by organizations to control the flow of information between designated sources and destinations (e.g., networks, individuals, devices) within information systems and between interconnected systems. \n\nFlow control is based on the characteristics of the information and/or the information path.",
|
|
488
|
+
"severity": "medium"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "V-51413",
|
|
492
|
+
"title": "Internet Sharing must be disabled.",
|
|
493
|
+
"description": "Internet Sharing must be disabled.",
|
|
494
|
+
"severity": "medium"
|
|
495
|
+
},
|
|
496
|
+
{
|
|
497
|
+
"id": "V-51415",
|
|
498
|
+
"title": "Web Sharing must be disabled.",
|
|
499
|
+
"description": "Web Sharing must be disabled.",
|
|
500
|
+
"severity": "medium"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "V-51417",
|
|
504
|
+
"title": "The rsh service must be disabled.",
|
|
505
|
+
"description": "Some networking protocols may not meet security requirements to protect data and components. The organization can either make a determination as to the relative security of the networking protocol or base the security decision on the assessment of other entities. Based on that assessment some may be deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.",
|
|
506
|
+
"severity": "high"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"id": "V-51419",
|
|
510
|
+
"title": "The operating system must enforce the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.",
|
|
511
|
+
"description": "By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.",
|
|
512
|
+
"severity": "medium"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "V-51421",
|
|
516
|
+
"title": "The operating system must use cryptography to protect the integrity of remote access sessions.",
|
|
517
|
+
"description": "Remote access is any access to an organizational operating system by a user (or an information system) communicating through an external, non-organization-controlled network. \n\nIf cryptography is not used to protect these sessions, then the session data traversing the remote connection could be intercepted and potentially modified. Cryptography provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of integrity. The encryption strength of mechanism is selected based on the security categorization of the information traversing the remote connection.",
|
|
518
|
+
"severity": "medium"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"id": "V-51425",
|
|
522
|
+
"title": "The operating system must ensure remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.",
|
|
523
|
+
"description": "Remote access is any access to an organizational operating system by a user (or an information system) communicating through an external, non-organization-controlled network. \n\nRemote access to security functions (e.g., user management, audit log management, etc.) and security-relevant information requires the activity be audited by the organization. Any operating system providing remote access must support organizational requirements to audit access or organization-defined security functions and security-relevant information.",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "V-51427",
|
|
528
|
+
"title": "The operating system must protect audit tools from unauthorized access.",
|
|
529
|
+
"description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. \n\nDepending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. \n\nIt is imperative that access to audit tools be controlled and protected from unauthorized access.",
|
|
530
|
+
"severity": "medium"
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"id": "V-51429",
|
|
534
|
+
"title": "The operating system must protect audit tools from unauthorized modification.",
|
|
535
|
+
"description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. \n\nDepending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. \n\nIf the tools are compromised it could provide attackers with the capability to manipulate log data. It is imperative that audit tools be controlled and protected from unauthorized modification.",
|
|
536
|
+
"severity": "medium"
|
|
537
|
+
},
|
|
538
|
+
{
|
|
539
|
+
"id": "V-51431",
|
|
540
|
+
"title": "The operating system must protect audit tools from unauthorized deletion.",
|
|
541
|
+
"description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. \n\nDepending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. If the tools are deleted, it would affect the administrator's ability to access and review log data.",
|
|
542
|
+
"severity": "medium"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "V-51433",
|
|
546
|
+
"title": "The operating system must limit privileges to change software resident within software libraries (including privileged programs).",
|
|
547
|
+
"description": "When dealing with change control issues, it should be noted that any changes to the hardware, software, and/or firmware components of the operating system can potentially have significant effects on the overall security of the system. \n\nOnly qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.",
|
|
548
|
+
"severity": "medium"
|
|
549
|
+
},
|
|
550
|
+
{
|
|
551
|
+
"id": "V-51435",
|
|
552
|
+
"title": "The operating system must take corrective actions, when unauthorized mobile code is identified.",
|
|
553
|
+
"description": "Decisions regarding the employment of mobile code within organizational information systems are based on the potential for the code to cause damage to the system if used maliciously. \n\nMobile code technologies include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. Usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations.",
|
|
554
|
+
"severity": "medium"
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"id": "V-51437",
|
|
558
|
+
"title": "The operating system must support the requirement to automatically audit on account creation.",
|
|
559
|
+
"description": "Auditing of account creation is a method and best practice for mitigating the risk of an attacker creating a persistent method of reestablishing access. A comprehensive account management process will ensure an audit trail which documents the creation of accounts and if required notifies administrators. Such a process greatly reduces the risk of accounts being created outside the normal approval process and provides logging that can be used for forensic purposes. Additionally, the audit records of account creation can be compared to the known approved account creation list.",
|
|
560
|
+
"severity": "medium"
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
"id": "V-51439",
|
|
564
|
+
"title": "The Bluetooth protocol driver must be removed.",
|
|
565
|
+
"description": "Wireless access introduces security risks which must be addressed through implementation of strict controls and procedures such as authentication, encryption, and defining what resources that can be accessed. The organization will define the requirements for connection of mobile devices. In order to ensure that the connection provides adequate integrity and confidentiality of the connection, the operating system must enforce these requirements.",
|
|
566
|
+
"severity": "low"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "V-51441",
|
|
570
|
+
"title": "Wi-Fi support software must be disabled.",
|
|
571
|
+
"description": "Wi-Fi support software must be disabled.",
|
|
572
|
+
"severity": "medium"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "V-51443",
|
|
576
|
+
"title": "The operating system must audit any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.",
|
|
577
|
+
"description": "The auditing system must be configured to audit authentication and authorization events.",
|
|
578
|
+
"severity": "medium"
|
|
579
|
+
},
|
|
580
|
+
{
|
|
581
|
+
"id": "V-51445",
|
|
582
|
+
"title": "Bluetooth devices must not be allowed to wake the computer.",
|
|
583
|
+
"description": "Bluetooth devices must not be allowed to wake the computer. If Bluetooth is not required, turn it off. If Bluetooth is necessary, disable allowing Bluetooth devices to awake the computer.",
|
|
584
|
+
"severity": "medium"
|
|
585
|
+
},
|
|
586
|
+
{
|
|
587
|
+
"id": "V-51447",
|
|
588
|
+
"title": "Bluetooth Sharing must be disabled.",
|
|
589
|
+
"description": "Bluetooth Sharing must be disabled.",
|
|
590
|
+
"severity": "medium"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"id": "V-51449",
|
|
594
|
+
"title": "The operating system must display the DoD-approved system use notification message or banner before granting access to the system.",
|
|
595
|
+
"description": "The operating system is required to display the DoD-approved system use notification message or banner before granting access to the system. This ensures all the legal requirements are met as far as auditing and monitoring are concerned.",
|
|
596
|
+
"severity": "low"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "V-51451",
|
|
600
|
+
"title": "The auditing tool, praudit, must be the one provided by Apple, Inc.",
|
|
601
|
+
"description": "Auditing and logging are key components of any security architecture. It is essential security personnel know what is being done, what was attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Cryptographic mechanisms must be used to protect the integrity of the audit tools used for audit reduction and reporting. The auditing tool, praudit, should be the one provided by Apple, Inc.",
|
|
602
|
+
"severity": "medium"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"id": "V-51453",
|
|
606
|
+
"title": "The input menu must not be shown in the login window.",
|
|
607
|
+
"description": "Input menu must not be shown in login window.",
|
|
608
|
+
"severity": "medium"
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "V-51455",
|
|
612
|
+
"title": "The auditing tool, auditreduce, must be the one provided by Apple, Inc.",
|
|
613
|
+
"description": "The auditing tool, auditreduce, should be the one provided by Apple, Inc.",
|
|
614
|
+
"severity": "medium"
|
|
615
|
+
},
|
|
616
|
+
{
|
|
617
|
+
"id": "V-51457",
|
|
618
|
+
"title": "The auditing tool, audit, must be the one provided by Apple, Inc.",
|
|
619
|
+
"description": "The auditing tool, audit, should be the one provided by Apple, Inc.",
|
|
620
|
+
"severity": "medium"
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"id": "V-51459",
|
|
624
|
+
"title": "The operating system, upon successful logon, must display to the user the date and time of the last logon (access).",
|
|
625
|
+
"description": "Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the date and time of their last successful login allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.",
|
|
626
|
+
"severity": "medium"
|
|
627
|
+
},
|
|
628
|
+
{
|
|
629
|
+
"id": "V-51461",
|
|
630
|
+
"title": "The auditing tool, auditd, must be the one provided by Apple, Inc.",
|
|
631
|
+
"description": "The auditing tool, auditd, should be the one provided by Apple, Inc.",
|
|
632
|
+
"severity": "medium"
|
|
633
|
+
},
|
|
634
|
+
{
|
|
635
|
+
"id": "V-51463",
|
|
636
|
+
"title": "Shared User Accounts must be disabled.",
|
|
637
|
+
"description": "Shared User Accounts must be disabled.",
|
|
638
|
+
"severity": "medium"
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"id": "V-51465",
|
|
642
|
+
"title": "The operating system must retain the session lock until the user reestablishes access using established identification and authentication procedures.",
|
|
643
|
+
"description": "A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the system but does not want to log out because of the temporary nature of the absence. \n\nOnce invoked, the session lock shall remain in place until the user reauthenticates. No other system activity aside from reauthentication can unlock the system.",
|
|
644
|
+
"severity": "medium"
|
|
645
|
+
},
|
|
646
|
+
{
|
|
647
|
+
"id": "V-51467",
|
|
648
|
+
"title": "A password must be required to unlock each System Preference Pane.",
|
|
649
|
+
"description": "A password must be required to access locked System Preferences.",
|
|
650
|
+
"severity": "medium"
|
|
651
|
+
},
|
|
652
|
+
{
|
|
653
|
+
"id": "V-51469",
|
|
654
|
+
"title": "Automatic logout due to inactivity must be disabled.",
|
|
655
|
+
"description": "Automatic logout due to inactivity must be disabled.",
|
|
656
|
+
"severity": "low"
|
|
657
|
+
},
|
|
658
|
+
{
|
|
659
|
+
"id": "V-51471",
|
|
660
|
+
"title": "Automatic login must be disabled.",
|
|
661
|
+
"description": "Automatic login must be disabled.",
|
|
662
|
+
"severity": "medium"
|
|
663
|
+
},
|
|
664
|
+
{
|
|
665
|
+
"id": "V-51473",
|
|
666
|
+
"title": "The operating system must initiate a session lock after the organization-defined time period of inactivity.",
|
|
667
|
+
"description": "A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the system but does not log out because of the temporary nature of the absence. \n\nThe organization defines the period of inactivity to pass before a session lock is initiated, so this must be configurable.",
|
|
668
|
+
"severity": "medium"
|
|
669
|
+
},
|
|
670
|
+
{
|
|
671
|
+
"id": "V-51475",
|
|
672
|
+
"title": "The ability to use corners to disable the screen saver must be disabled.",
|
|
673
|
+
"description": "The ability to use corners to disable the screen saver must be disabled.",
|
|
674
|
+
"severity": "medium"
|
|
675
|
+
},
|
|
676
|
+
{
|
|
677
|
+
"id": "V-51477",
|
|
678
|
+
"title": "The operating system session lock mechanism, when activated on a device with a display screen, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.",
|
|
679
|
+
"description": "A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the system but does not log out because of the temporary nature of the absence. \n\nThe session lock will also include an obfuscation of the display screen to prevent other users from reading what was previously displayed.",
|
|
680
|
+
"severity": "low"
|
|
681
|
+
},
|
|
682
|
+
{
|
|
683
|
+
"id": "V-51479",
|
|
684
|
+
"title": "The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods.",
|
|
685
|
+
"description": "Remote network access is accomplished by leveraging common communication protocols and establishing a remote connection. \n\nRemote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless. \n\nAutomated monitoring of remote access sessions allows organizations to audit user activities on a variety of information system components (e.g., servers, workstations, notebook/laptop computers) and to ensure compliance with remote access policy.",
|
|
686
|
+
"severity": "medium"
|
|
687
|
+
},
|
|
688
|
+
{
|
|
689
|
+
"id": "V-51481",
|
|
690
|
+
"title": "The rexec service must be disabled.",
|
|
691
|
+
"description": "Remote network access is accomplished by leveraging common communication protocols and establishing a remote connection. These connections will occur over the public Internet. \n\nRemote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless. \n\nUsing cryptography ensures confidentiality of the remote access connections.",
|
|
692
|
+
"severity": "high"
|
|
693
|
+
},
|
|
694
|
+
{
|
|
695
|
+
"id": "V-51483",
|
|
696
|
+
"title": "The operating system must monitor for unauthorized connections of mobile devices to organizational information systems.",
|
|
697
|
+
"description": "Mobile devices include portable storage media (e.g., USB memory sticks, external hard disk drives) and portable computing and communications devices with information storage capability (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, digital cameras, audio recording devices). \n\nOrganization-controlled mobile devices include those devices for which the organization has the authority to specify and the ability to enforce specific security requirements.\n\nUsage restrictions and implementation guidance related to mobile devices include, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared).\n\nIn order to detect unauthorized mobile device connections, organizations must first identify and document what mobile devices are authorized.",
|
|
698
|
+
"severity": "medium"
|
|
699
|
+
},
|
|
700
|
+
{
|
|
701
|
+
"id": "V-51485",
|
|
702
|
+
"title": "Automatic actions must be disabled for blank CDs.",
|
|
703
|
+
"description": "Automatic actions must be disabled for blank CDs.",
|
|
704
|
+
"severity": "medium"
|
|
705
|
+
},
|
|
706
|
+
{
|
|
707
|
+
"id": "V-51487",
|
|
708
|
+
"title": "Automatic actions must be disabled for blank DVDs.",
|
|
709
|
+
"description": "Automatic actions must be disabled for blank DVDs.",
|
|
710
|
+
"severity": "medium"
|
|
711
|
+
},
|
|
712
|
+
{
|
|
713
|
+
"id": "V-51489",
|
|
714
|
+
"title": "Automatic actions must be disabled for music CDs.",
|
|
715
|
+
"description": "Automatic actions must be disabled for music CDs.",
|
|
716
|
+
"severity": "medium"
|
|
717
|
+
},
|
|
718
|
+
{
|
|
719
|
+
"id": "V-51491",
|
|
720
|
+
"title": "Automatic actions must be disabled for video DVDs.",
|
|
721
|
+
"description": "Automatic actions must be disabled for video DVDs.",
|
|
722
|
+
"severity": "medium"
|
|
723
|
+
},
|
|
724
|
+
{
|
|
725
|
+
"id": "V-51493",
|
|
726
|
+
"title": "The operating system must allocate audit record storage capacity.",
|
|
727
|
+
"description": "Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.\n\nIt is imperative the operating system configured, allocate storage capacity to contain audit records.",
|
|
728
|
+
"severity": "medium"
|
|
729
|
+
},
|
|
730
|
+
{
|
|
731
|
+
"id": "V-51495",
|
|
732
|
+
"title": "The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.",
|
|
733
|
+
"description": "Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.\n\nCare must be taken to evaluate that the audit records being produced do not exceed the storage capacity.",
|
|
734
|
+
"severity": "medium"
|
|
735
|
+
},
|
|
736
|
+
{
|
|
737
|
+
"id": "V-51497",
|
|
738
|
+
"title": "The operating system must take organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).",
|
|
739
|
+
"description": "It is critical when a system is at risk of failing to process audit logs, as required, it detects and takes action to mitigate the failure. Audit processing failures include, software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nIn order for the audit control system to shut down when an audit processing failure occurs, the setting \"ahlt\" must be configured. The default setting is \"cnt\" which allows the system to continue running in the event of an audit processing failure.",
|
|
740
|
+
"severity": "medium"
|
|
741
|
+
},
|
|
742
|
+
{
|
|
743
|
+
"id": "V-51499",
|
|
744
|
+
"title": "The operating system must provide a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.",
|
|
745
|
+
"description": "It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include, software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. \n\nIf audit log capacity were to be exceeded then events that subsequently occur will not be recorded.",
|
|
746
|
+
"severity": "medium"
|
|
747
|
+
},
|
|
748
|
+
{
|
|
749
|
+
"id": "V-51501",
|
|
750
|
+
"title": "The operating system must provide a real-time alert when organization-defined audit failure events occur.",
|
|
751
|
+
"description": "It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include, software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. \n\nOrganizations must define audit failure events requiring an application to send an alarm. When those defined events occur, the application will provide a real-time alert to the appropriate personnel.",
|
|
752
|
+
"severity": "medium"
|
|
753
|
+
},
|
|
754
|
+
{
|
|
755
|
+
"id": "V-51507",
|
|
756
|
+
"title": "The operating system must employ cryptographic mechanisms to protect information in storage.",
|
|
757
|
+
"description": "When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. \n\nAn organizational assessment of risk guides the selection of media and associated information contained on the media requiring restricted access. Organizations need to document in policy and procedures the media requiring restricted access, individuals authorized to access the media, and the specific measures taken to restrict access. \n\nFewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact if accessed by other than authorized personnel. In these situations, it is assumed the physical access controls where the media resides provide adequate protection. \n\nAs part of a defense-in-depth strategy, the organization considers routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner/steward. The selection of the cryptographic mechanisms used is based upon maintaining the confidentiality and integrity of the information.",
|
|
758
|
+
"severity": "medium"
|
|
759
|
+
},
|
|
760
|
+
{
|
|
761
|
+
"id": "V-51509",
|
|
762
|
+
"title": "The operating system must employ cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.",
|
|
763
|
+
"description": "Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. To protect the integrity and confidentiality of non-local maintenance and diagnostics, all packets associated with these sessions must be encrypted.",
|
|
764
|
+
"severity": "medium"
|
|
765
|
+
},
|
|
766
|
+
{
|
|
767
|
+
"id": "V-51511",
|
|
768
|
+
"title": "The operating system must employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions.",
|
|
769
|
+
"description": "Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. \n\nThe act of managing systems includes the ability to access system configuration details, diagnostic information, user information, as well as installation of software.",
|
|
770
|
+
"severity": "medium"
|
|
771
|
+
},
|
|
772
|
+
{
|
|
773
|
+
"id": "V-51515",
|
|
774
|
+
"title": "The operating system must automatically terminate emergency accounts after an organization-defined time period for each type of account.",
|
|
775
|
+
"description": "When emergency accounts are created, there is a risk that the emergency account may remain in place and active after the need for the account no longer exists. To address this, in the event emergency accounts are required, accounts that are designated as temporary in nature must be automatically terminated after an organization-defined time period. Such a process and capability greatly reduces the risk that accounts will be misused, hijacked, or data compromised.",
|
|
776
|
+
"severity": "medium"
|
|
777
|
+
},
|
|
778
|
+
{
|
|
779
|
+
"id": "V-51519",
|
|
780
|
+
"title": "The operating system must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.",
|
|
781
|
+
"description": "An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. \n\nTechniques used to address this include protocols using challenges (e.g., TLS, WS_Security), time synchronous, or challenge-response one-time authenticators.",
|
|
782
|
+
"severity": "medium"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"id": "V-51523",
|
|
786
|
+
"title": "The operating system must use organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.",
|
|
787
|
+
"description": "An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. \n\nTechniques used to address this include protocols using challenges (e.g., TLS, WS_Security), time synchronous, or challenge-response one-time authenticators.",
|
|
788
|
+
"severity": "medium"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
"id": "V-51527",
|
|
792
|
+
"title": "The root account must be disabled for interactive use.",
|
|
793
|
+
"description": "The root account must be disabled for interactive use.",
|
|
794
|
+
"severity": "medium"
|
|
795
|
+
},
|
|
796
|
+
{
|
|
797
|
+
"id": "V-51529",
|
|
798
|
+
"title": "The SSH PermitRootLogin option must be set correctly.",
|
|
799
|
+
"description": "To assure individual accountability and prevent unauthorized access, organizational users shall be individually identified and authenticated. \n\nUsers (and any processes acting on behalf of users) need to be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization which outlines specific user actions that can be performed on the operating system without identification or authentication.\n\nRequiring individuals to be authenticated with an individual authenticator prior to using a group authenticator allows for traceability of actions, as well as, adding an additional level of protection of the actions that can be taken with group account knowledge.",
|
|
800
|
+
"severity": "medium"
|
|
801
|
+
},
|
|
802
|
+
{
|
|
803
|
+
"id": "V-51531",
|
|
804
|
+
"title": "End users must not be able to override Gatekeeper settings.",
|
|
805
|
+
"description": "Gatekeeper settings must be configured correctly.",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "V-51535",
|
|
810
|
+
"title": "The system must allow only applications downloaded from the App Store to run.",
|
|
811
|
+
"description": "Gatekeeper settings must be configured correctly.",
|
|
812
|
+
"severity": "medium"
|
|
813
|
+
},
|
|
814
|
+
{
|
|
815
|
+
"id": "V-51537",
|
|
816
|
+
"title": "A configuration profile must exist to restrict launching of applications.",
|
|
817
|
+
"description": "The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization.",
|
|
818
|
+
"severity": "medium"
|
|
819
|
+
},
|
|
820
|
+
{
|
|
821
|
+
"id": "V-51539",
|
|
822
|
+
"title": "The operating system must conduct backups of system-level information contained in the information system per organization-defined frequency that are consistent with recovery time and recovery point objectives.",
|
|
823
|
+
"description": "Operating system backup is a critical step in maintaining data assurance and availability. \n\nSystem-level information includes system-state information, operating system and application software, and licenses. \n\nBackups must be consistent with organizational recovery time and recovery point objectives.",
|
|
824
|
+
"severity": "low"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"id": "V-51541",
|
|
828
|
+
"title": "The operating system must conduct backups of user-level information contained in the operating system per organization-defined frequency consistent with recovery time and recovery point objectives.",
|
|
829
|
+
"description": "Operating system backup is a critical step in maintaining data assurance and availability. \n\nUser-level information is data generated by information system and/or application users.\n\nBackups shall be consistent with organizational recovery time and recovery point objectives.",
|
|
830
|
+
"severity": "low"
|
|
831
|
+
},
|
|
832
|
+
{
|
|
833
|
+
"id": "V-51543",
|
|
834
|
+
"title": "Airdrop must be disabled.",
|
|
835
|
+
"description": "Airdrop must be disabled.",
|
|
836
|
+
"severity": "low"
|
|
837
|
+
},
|
|
838
|
+
{
|
|
839
|
+
"id": "V-51547",
|
|
840
|
+
"title": "The system must not have the UUCP service active.",
|
|
841
|
+
"description": "The system must not have the UUCP service active.",
|
|
842
|
+
"severity": "medium"
|
|
843
|
+
},
|
|
844
|
+
{
|
|
845
|
+
"id": "V-51549",
|
|
846
|
+
"title": "Bonjour multicast advertising must be disabled on the system.",
|
|
847
|
+
"description": "Bonjour multicast advertising must be disabled on the system.",
|
|
848
|
+
"severity": "medium"
|
|
849
|
+
},
|
|
850
|
+
{
|
|
851
|
+
"id": "V-51551",
|
|
852
|
+
"title": "Location Services must be disabled.",
|
|
853
|
+
"description": "Location Services must be disabled.",
|
|
854
|
+
"severity": "medium"
|
|
855
|
+
},
|
|
856
|
+
{
|
|
857
|
+
"id": "V-51553",
|
|
858
|
+
"title": "Find My Mac messenger must be disabled.",
|
|
859
|
+
"description": "Find My Mac messenger must be disabled.",
|
|
860
|
+
"severity": "medium"
|
|
861
|
+
},
|
|
862
|
+
{
|
|
863
|
+
"id": "V-51555",
|
|
864
|
+
"title": "Find My Mac must be disabled.",
|
|
865
|
+
"description": "Find My Mac must be disabled.",
|
|
866
|
+
"severity": "medium"
|
|
867
|
+
},
|
|
868
|
+
{
|
|
869
|
+
"id": "V-51557",
|
|
870
|
+
"title": "Sending diagnostic and usage data to Apple must be disabled.",
|
|
871
|
+
"description": "Sending diagnostic and usage data to Apple must be disabled.",
|
|
872
|
+
"severity": "medium"
|
|
873
|
+
},
|
|
874
|
+
{
|
|
875
|
+
"id": "V-51559",
|
|
876
|
+
"title": "Remote Apple Events must be disabled.",
|
|
877
|
+
"description": "Remote Apple Events must be disabled.",
|
|
878
|
+
"severity": "medium"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
"id": "V-51561",
|
|
882
|
+
"title": "The system preference panel iCloud must be removed.",
|
|
883
|
+
"description": "The system preference panel iCloud must be removed.",
|
|
884
|
+
"severity": "medium"
|
|
885
|
+
},
|
|
886
|
+
{
|
|
887
|
+
"id": "V-51565",
|
|
888
|
+
"title": "The application Mail must be removed.",
|
|
889
|
+
"description": "The application Mail must be removed.",
|
|
890
|
+
"severity": "low"
|
|
891
|
+
},
|
|
892
|
+
{
|
|
893
|
+
"id": "V-51567",
|
|
894
|
+
"title": "The application Contacts must be removed.",
|
|
895
|
+
"description": "The application Contacts must be removed.",
|
|
896
|
+
"severity": "low"
|
|
897
|
+
},
|
|
898
|
+
{
|
|
899
|
+
"id": "V-51569",
|
|
900
|
+
"title": "The application Calendar must be removed.",
|
|
901
|
+
"description": "The application Calendar must be removed.",
|
|
902
|
+
"severity": "low"
|
|
903
|
+
},
|
|
904
|
+
{
|
|
905
|
+
"id": "V-51571",
|
|
906
|
+
"title": "The application App Store must be removed.",
|
|
907
|
+
"description": "The application App Store must be removed.",
|
|
908
|
+
"severity": "medium"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "V-51575",
|
|
912
|
+
"title": "The application image capture must be removed.",
|
|
913
|
+
"description": "The application Image Capture must be removed.",
|
|
914
|
+
"severity": "low"
|
|
915
|
+
},
|
|
916
|
+
{
|
|
917
|
+
"id": "V-51579",
|
|
918
|
+
"title": "The application Messages must be removed.",
|
|
919
|
+
"description": "The application Messages must be removed.",
|
|
920
|
+
"severity": "medium"
|
|
921
|
+
},
|
|
922
|
+
{
|
|
923
|
+
"id": "V-51581",
|
|
924
|
+
"title": "The application iTunes must be removed.",
|
|
925
|
+
"description": "The application iTunes must be removed.",
|
|
926
|
+
"severity": "low"
|
|
927
|
+
},
|
|
928
|
+
{
|
|
929
|
+
"id": "V-51583",
|
|
930
|
+
"title": "The application Game Center must be disabled.",
|
|
931
|
+
"description": "The application Game Center must be disabled.",
|
|
932
|
+
"severity": "low"
|
|
933
|
+
},
|
|
934
|
+
{
|
|
935
|
+
"id": "V-51593",
|
|
936
|
+
"title": "The application Game Center must be removed.",
|
|
937
|
+
"description": "The application Game Center must be removed.",
|
|
938
|
+
"severity": "low"
|
|
939
|
+
},
|
|
940
|
+
{
|
|
941
|
+
"id": "V-51595",
|
|
942
|
+
"title": "The application FaceTime must be removed.",
|
|
943
|
+
"description": "The application FaceTime must be removed.",
|
|
944
|
+
"severity": "low"
|
|
945
|
+
},
|
|
946
|
+
{
|
|
947
|
+
"id": "V-51597",
|
|
948
|
+
"title": "The application Chess must be removed.",
|
|
949
|
+
"description": "The application Chess must be removed.",
|
|
950
|
+
"severity": "low"
|
|
951
|
+
},
|
|
952
|
+
{
|
|
953
|
+
"id": "V-51601",
|
|
954
|
+
"title": "The application PhotoBooth must be removed.",
|
|
955
|
+
"description": "The application Photo Booth must be removed.",
|
|
956
|
+
"severity": "low"
|
|
957
|
+
},
|
|
958
|
+
{
|
|
959
|
+
"id": "V-51603",
|
|
960
|
+
"title": "Application Restrictions must be enabled.",
|
|
961
|
+
"description": "Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions) and will reduce the attack surface of the operating system. End-users should be restricted to running only approved applications.",
|
|
962
|
+
"severity": "medium"
|
|
963
|
+
},
|
|
964
|
+
{
|
|
965
|
+
"id": "V-51605",
|
|
966
|
+
"title": "The racoon daemon must be disabled.",
|
|
967
|
+
"description": "Depending on the information sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization.\n\nThe operating system must restrict data in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) and must provide the capability to automatically enable authorized users to make information sharing decisions based upon access authorizations.\n\nThe IKE service, racoon, should be disabled.",
|
|
968
|
+
"severity": "medium"
|
|
969
|
+
},
|
|
970
|
+
{
|
|
971
|
+
"id": "V-51609",
|
|
972
|
+
"title": "The NFS stat daemon must be disabled.",
|
|
973
|
+
"description": "Depending on the information sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization.\n\nThe operating system must restrict data in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) and must provide the capability to automatically enable authorized users to make information sharing decisions based upon access authorizations.\n\nNFS should be disabled.",
|
|
974
|
+
"severity": "medium"
|
|
975
|
+
},
|
|
976
|
+
{
|
|
977
|
+
"id": "V-51619",
|
|
978
|
+
"title": "The NFS lock daemon must be disabled.",
|
|
979
|
+
"description": "Depending on the information sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization.\n\nThe operating system must restrict data in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) and must provide the capability to automatically enable authorized users to make information sharing decisions based upon access authorizations.\n\nNFS should be disabled.",
|
|
980
|
+
"severity": "medium"
|
|
981
|
+
},
|
|
982
|
+
{
|
|
983
|
+
"id": "V-51621",
|
|
984
|
+
"title": "The system must be configured to set the time automatically from a network time server.",
|
|
985
|
+
"description": "The system must be configured to set the time automatically from a network time server.",
|
|
986
|
+
"severity": "low"
|
|
987
|
+
},
|
|
988
|
+
{
|
|
989
|
+
"id": "V-51623",
|
|
990
|
+
"title": "The network time server must be an authorized DoD time source.",
|
|
991
|
+
"description": "The system must be configured to set the time automatically from a network time server. The network time server must be an authorized DoD time source.",
|
|
992
|
+
"severity": "medium"
|
|
993
|
+
},
|
|
994
|
+
{
|
|
995
|
+
"id": "V-51625",
|
|
996
|
+
"title": "Audit Log files must have the correct permissions.",
|
|
997
|
+
"description": "If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult if not impossible to achieve. Audit Log files should have the correct permissions.\n\nTo ensure the veracity of audit data the operating system must protect audit information from unauthorized access. \n\nThis requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files have the proper file system permissions utilizing file system protections and limiting log data location. \n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.",
|
|
998
|
+
"severity": "medium"
|
|
999
|
+
},
|
|
1000
|
+
{
|
|
1001
|
+
"id": "V-51627",
|
|
1002
|
+
"title": "Audit log files must be owned by root:wheel.",
|
|
1003
|
+
"description": "Audit log files should be owned by root:wheel.",
|
|
1004
|
+
"severity": "medium"
|
|
1005
|
+
},
|
|
1006
|
+
{
|
|
1007
|
+
"id": "V-51629",
|
|
1008
|
+
"title": "The NFS daemon must be disabled.",
|
|
1009
|
+
"description": "Depending on the information sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization.\n\nThe operating system must restrict data in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) and must provide the capability to automatically enable authorized users to make information sharing decisions based upon access authorizations.\n\nNFS should be disabled.",
|
|
1010
|
+
"severity": "medium"
|
|
1011
|
+
},
|
|
1012
|
+
{
|
|
1013
|
+
"id": "V-51631",
|
|
1014
|
+
"title": "Audit log files must not contain ACLs.",
|
|
1015
|
+
"description": "Audit log files should not contain ACLs.",
|
|
1016
|
+
"severity": "medium"
|
|
1017
|
+
},
|
|
1018
|
+
{
|
|
1019
|
+
"id": "V-51633",
|
|
1020
|
+
"title": "Apple File Sharing must be disabled.",
|
|
1021
|
+
"description": "Depending on the information sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization.\n\nThe operating system must restrict data in some manner (e.g., privileged medical, contract-sensitive, proprietary, personally identifiable information, special access programs/compartments) and must provide the capability to automatically enable authorized users to make information sharing decisions based upon access authorizations.",
|
|
1022
|
+
"severity": "medium"
|
|
1023
|
+
},
|
|
1024
|
+
{
|
|
1025
|
+
"id": "V-51635",
|
|
1026
|
+
"title": "Audit Log files must have the correct permissions.",
|
|
1027
|
+
"description": "If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. \n\nTo ensure the veracity of audit data the operating system must protect audit information from unauthorized modification. \n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.",
|
|
1028
|
+
"severity": "medium"
|
|
1029
|
+
},
|
|
1030
|
+
{
|
|
1031
|
+
"id": "V-51639",
|
|
1032
|
+
"title": "The operating system must employ automated mechanisms to centrally verify configuration settings.",
|
|
1033
|
+
"description": "Configuration settings are the configurable security-related parameters of information technology products that are part of the information system. Security-related parameters are those parameters impacting the security state of the system including parameters related to meeting other security control requirements. \n\nRather than visiting each and every system when verifying configuration changes, organizations will employ automated tools that can make changes across all systems. This greatly increases efficiency and manageability of applications in a large scale environment.",
|
|
1034
|
+
"severity": "medium"
|
|
1035
|
+
},
|
|
1036
|
+
{
|
|
1037
|
+
"id": "V-51641",
|
|
1038
|
+
"title": "Audit log files must be owned by root:wheel.",
|
|
1039
|
+
"description": "Audit log files should be owned by root:wheel.",
|
|
1040
|
+
"severity": "medium"
|
|
1041
|
+
},
|
|
1042
|
+
{
|
|
1043
|
+
"id": "V-51643",
|
|
1044
|
+
"title": "The audit log folder must be owned by root:wheel.",
|
|
1045
|
+
"description": "If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. \n\nTo ensure the veracity of audit data the operating system must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods which will depend upon system architecture and design. \n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.",
|
|
1046
|
+
"severity": "medium"
|
|
1047
|
+
},
|
|
1048
|
+
{
|
|
1049
|
+
"id": "V-51645",
|
|
1050
|
+
"title": "Configuration profiles must be applied to the system.",
|
|
1051
|
+
"description": "Configuration settings are the configurable security-related parameters of the operating system. \n\nSecurity-related parameters are those parameters impacting the security state of the system including parameters related to meeting other security control requirements. \n\nRather than visiting each and every system when making configuration changes, organizations will employ automated tools that can make changes across all systems. This greatly increases efficiency and manageability of applications in a large scale environment.",
|
|
1052
|
+
"severity": "medium"
|
|
1053
|
+
},
|
|
1054
|
+
{
|
|
1055
|
+
"id": "V-51647",
|
|
1056
|
+
"title": "The audit log folder must have the correct permissions.",
|
|
1057
|
+
"description": "The audit log folder should have correct permissions.",
|
|
1058
|
+
"severity": "medium"
|
|
1059
|
+
},
|
|
1060
|
+
{
|
|
1061
|
+
"id": "V-51651",
|
|
1062
|
+
"title": "The audit log folder must not have ACLs.",
|
|
1063
|
+
"description": "The audit log folder should not have ACLs.",
|
|
1064
|
+
"severity": "medium"
|
|
1065
|
+
},
|
|
1066
|
+
{
|
|
1067
|
+
"id": "V-51653",
|
|
1068
|
+
"title": "The audit log folder must have correct permissions.",
|
|
1069
|
+
"description": "Non-repudiation of actions taken is required in order to maintain integrity. To do this, we will prevent users from modifying the audit logs.\n\nNon-repudiation protects individuals against later claims by an author of not having updated a particular file, invoked a specific command, or copied a specific file.",
|
|
1070
|
+
"severity": "medium"
|
|
1071
|
+
},
|
|
1072
|
+
{
|
|
1073
|
+
"id": "V-51655",
|
|
1074
|
+
"title": "The Security assessment policy subsystem must be enabled.",
|
|
1075
|
+
"description": "Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. \n\nAccordingly, software defined by the organization as critical software must be signed with a certificate that is recognized and approved by the organization.",
|
|
1076
|
+
"severity": "high"
|
|
1077
|
+
},
|
|
1078
|
+
{
|
|
1079
|
+
"id": "V-51657",
|
|
1080
|
+
"title": "The audit log folder must be owned by root:wheel.",
|
|
1081
|
+
"description": "Non-repudiation of actions taken is required in order to maintain integrity. To do this, we will prevent users from modifying the audit logs.\n\nNon-repudiation protects individuals against later claims by an author of not having updated a particular file, invoked a specific command, or copied a specific file.",
|
|
1082
|
+
"severity": "medium"
|
|
1083
|
+
},
|
|
1084
|
+
{
|
|
1085
|
+
"id": "V-51659",
|
|
1086
|
+
"title": "The audit log folder must be owned by root:wheel.",
|
|
1087
|
+
"description": "Non-repudiation of actions taken is required in order to maintain integrity. To do this, we will prevent users from modifying the audit logs.\n\nNon-repudiation protects individuals against later claims by an author of not having updated a particular file, invoked a specific command, or copied a specific file.",
|
|
1088
|
+
"severity": "medium"
|
|
1089
|
+
},
|
|
1090
|
+
{
|
|
1091
|
+
"id": "V-51663",
|
|
1092
|
+
"title": "The password-related hint field must not be used.",
|
|
1093
|
+
"description": "The password-related hint field must not be used.",
|
|
1094
|
+
"severity": "medium"
|
|
1095
|
+
},
|
|
1096
|
+
{
|
|
1097
|
+
"id": "V-51665",
|
|
1098
|
+
"title": "The audit log folder must have correct permissions.",
|
|
1099
|
+
"description": "Non-repudiation of actions taken is required in order to maintain integrity. To do this, we will prevent users from modifying the audit logs.\n\nNon-repudiation protects individuals against later claims by an author of not having updated a particular file, invoked a specific command, or copied a specific file.",
|
|
1100
|
+
"severity": "medium"
|
|
1101
|
+
},
|
|
1102
|
+
{
|
|
1103
|
+
"id": "V-51667",
|
|
1104
|
+
"title": "The audit log files must not contain ACLs.",
|
|
1105
|
+
"description": "The audit log files should not contain ACLs.",
|
|
1106
|
+
"severity": "medium"
|
|
1107
|
+
},
|
|
1108
|
+
{
|
|
1109
|
+
"id": "V-51671",
|
|
1110
|
+
"title": "The operating system must provide audit record generation capability for the auditable events defined in at the organizational level for the organization-defined information system components.",
|
|
1111
|
+
"description": "The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events) for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.",
|
|
1112
|
+
"severity": "medium"
|
|
1113
|
+
},
|
|
1114
|
+
{
|
|
1115
|
+
"id": "V-51673",
|
|
1116
|
+
"title": "The flags option must be set in /etc/security/audit_control.",
|
|
1117
|
+
"description": "The list of audited events is the set of events for which audits are to be generated. \n\nThis set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events).",
|
|
1118
|
+
"severity": "medium"
|
|
1119
|
+
},
|
|
1120
|
+
{
|
|
1121
|
+
"id": "V-51675",
|
|
1122
|
+
"title": "The operating system must enforce minimum password length.",
|
|
1123
|
+
"description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. \n\nPassword length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password is, the lower the number of possible combinations that need to be tested before the password is compromised. \n\nUse of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.",
|
|
1124
|
+
"severity": "medium"
|
|
1125
|
+
},
|
|
1126
|
+
{
|
|
1127
|
+
"id": "V-51677",
|
|
1128
|
+
"title": "The OS X firewall must have logging enabled.",
|
|
1129
|
+
"description": "Firewall logging must be enabled. This requirement is NA if HBSS is used.",
|
|
1130
|
+
"severity": "medium"
|
|
1131
|
+
},
|
|
1132
|
+
{
|
|
1133
|
+
"id": "V-51679",
|
|
1134
|
+
"title": "The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.",
|
|
1135
|
+
"description": "Audit generation and audit records can be generated from various components within the information system. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events). \n\nThe events that occur must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet a certain tolerance criteria. \n\nThe operating system must be able to have audit events correlated to the level of tolerance determined by the organization.",
|
|
1136
|
+
"severity": "medium"
|
|
1137
|
+
},
|
|
1138
|
+
{
|
|
1139
|
+
"id": "V-51681",
|
|
1140
|
+
"title": "The OCSPStyle option must be set correctly.",
|
|
1141
|
+
"description": "A trust anchor is an authoritative entity represented via a public key and associated data. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor, for example, a Certification Authority (CA). A certification path starts with the Subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nPath validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted. \n\nStatus information for certification paths includes, certificate revocation lists or online certificate status protocol responses.",
|
|
1142
|
+
"severity": "medium"
|
|
1143
|
+
},
|
|
1144
|
+
{
|
|
1145
|
+
"id": "V-51683",
|
|
1146
|
+
"title": "The OCSPSufficientPerCert option must be set correctly.",
|
|
1147
|
+
"description": "A trust anchor is an authoritative entity represented via a public key and associated data. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor, for example, a Certification Authority (CA). A certification path starts with the Subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nPath validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted. \n\nStatus information for certification paths includes, certificate revocation lists or online certificate status protocol responses.",
|
|
1148
|
+
"severity": "medium"
|
|
1149
|
+
},
|
|
1150
|
+
{
|
|
1151
|
+
"id": "V-51685",
|
|
1152
|
+
"title": "The RevocationFirst option must be set correctly.",
|
|
1153
|
+
"description": "A trust anchor is an authoritative entity represented via a public key and associated data. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor, for example, a Certification Authority (CA). A certification path starts with the Subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nPath validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted. \n\nStatus information for certification paths includes, certificate revocation lists or online certificate status protocol responses.",
|
|
1154
|
+
"severity": "medium"
|
|
1155
|
+
},
|
|
1156
|
+
{
|
|
1157
|
+
"id": "V-51687",
|
|
1158
|
+
"title": "The telnet service must be disabled.",
|
|
1159
|
+
"description": "Passwords need to be protected at all times and encryption is the standard method for protecting passwords during transmission to ensure unauthorized users/processes do not gain access to them.",
|
|
1160
|
+
"severity": "high"
|
|
1161
|
+
},
|
|
1162
|
+
{
|
|
1163
|
+
"id": "V-51689",
|
|
1164
|
+
"title": "There must be no .netrc files on the system.",
|
|
1165
|
+
"description": "Passwords need to be protected at all times and encryption is the standard method for protecting passwords while in storage so unauthorized users/processes cannot gain access. There must be no \".netrc\" files on the system.",
|
|
1166
|
+
"severity": "medium"
|
|
1167
|
+
},
|
|
1168
|
+
{
|
|
1169
|
+
"id": "V-51691",
|
|
1170
|
+
"title": "The CRLSufficientPerCert option must be set correctly.",
|
|
1171
|
+
"description": "A trust anchor is an authoritative entity represented via a public key and associated data. \n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor, for example, a Certification Authority (CA). A certification path starts with the Subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. \n\nPath validation is necessary for a relying party to make an informed trust decision when presented with any certificate that is not already explicitly trusted. \n\nStatus information for certification paths includes, certificate revocation lists or online certificate status protocol responses.",
|
|
1172
|
+
"severity": "medium"
|
|
1173
|
+
},
|
|
1174
|
+
{
|
|
1175
|
+
"id": "V-51785",
|
|
1176
|
+
"title": "The operating system must employ automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.",
|
|
1177
|
+
"description": "Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.",
|
|
1178
|
+
"severity": "medium"
|
|
1179
|
+
},
|
|
1180
|
+
{
|
|
1181
|
+
"id": "V-51845",
|
|
1182
|
+
"title": "Automatic actions must be disabled for picture CDs.",
|
|
1183
|
+
"description": "Automatic actions must be disabled for picture CDs.",
|
|
1184
|
+
"severity": "medium"
|
|
1185
|
+
},
|
|
1186
|
+
{
|
|
1187
|
+
"id": "V-51847",
|
|
1188
|
+
"title": "Bluetooth support software must be disabled.",
|
|
1189
|
+
"description": "Bluetooth support software must be disabled.",
|
|
1190
|
+
"severity": "medium"
|
|
1191
|
+
},
|
|
1192
|
+
{
|
|
1193
|
+
"id": "V-51929",
|
|
1194
|
+
"title": "Infrared [IR] support must be removed.",
|
|
1195
|
+
"description": "Infrared [IR] support must be removed.",
|
|
1196
|
+
"severity": "medium"
|
|
1197
|
+
},
|
|
1198
|
+
{
|
|
1199
|
+
"id": "V-53857",
|
|
1200
|
+
"title": "The FireWire protocol driver must be removed or disabled.",
|
|
1201
|
+
"description": "Malicious code is known to propagate via removable media such as floppy disks, USB or flash drives, and removable hard drives. \n\nIn order to prevent propagation and potential infection due to malware contained on removable media the operating system must be able to restrict and/or limit the use of removable media.",
|
|
1202
|
+
"severity": "medium"
|
|
1203
|
+
},
|
|
1204
|
+
{
|
|
1205
|
+
"id": "V-53859",
|
|
1206
|
+
"title": "The USB mass storage driver must be removed or disabled.",
|
|
1207
|
+
"description": "Malicious code is known to propagate via removable media such as floppy disks, USB or flash drives, and removable hard drives. \n\nIn order to prevent propagation and potential infection due to malware contained on removable media the operating system must be able to restrict and/or limit the use of removable media.",
|
|
1208
|
+
"severity": "medium"
|
|
1209
|
+
},
|
|
1210
|
+
{
|
|
1211
|
+
"id": "V-53861",
|
|
1212
|
+
"title": "The Apple Storage Drivers must be removed or disabled.",
|
|
1213
|
+
"description": "Malicious code is known to propagate via removable media such as floppy disks, USB or flash drives, and removable hard drives. \n\nIn order to prevent propagation and potential infection due to malware contained on removable media the operating system must be able to restrict and/or limit the use of removable media.",
|
|
1214
|
+
"severity": "medium"
|
|
1215
|
+
},
|
|
1216
|
+
{
|
|
1217
|
+
"id": "V-53863",
|
|
1218
|
+
"title": "The iPod Driver must be removed.",
|
|
1219
|
+
"description": "Malicious code is known to propagate via removable media such as floppy disks, USB or flash drives, and removable hard drives. \n\nIn order to prevent propagation and potential infection due to malware contained on removable media the operating system must be able to restrict and/or limit the use of removable media.",
|
|
1220
|
+
"severity": "medium"
|
|
1221
|
+
},
|
|
1222
|
+
{
|
|
1223
|
+
"id": "V-53865",
|
|
1224
|
+
"title": "All users must use PKI authentication for login and privileged access.",
|
|
1225
|
+
"description": "Password-based authentication has become a prime target for malicious actors. Multifactor authentication using PKI technologies mitigates most, if not all, risks associated with traditional password use. (Use of username and password for last-resort emergency access to a system for maintenance is acceptable, however.)",
|
|
1226
|
+
"severity": "medium"
|
|
1227
|
+
},
|
|
1228
|
+
{
|
|
1229
|
+
"id": "V-53867",
|
|
1230
|
+
"title": "The system must be integrated into a directory services infrastructure.",
|
|
1231
|
+
"description": "Distinct user account databases on each separate system cause problems with username and password policy enforcement. Most approved directory services infrastructure solutions, such as Active Directory, allow centralized management of users and passwords.",
|
|
1232
|
+
"severity": "medium"
|
|
1233
|
+
},
|
|
1234
|
+
{
|
|
1235
|
+
"id": "V-53869",
|
|
1236
|
+
"title": "The usbmuxd daemon must be disabled.",
|
|
1237
|
+
"description": "Connections to unauthorized iOS devices (iPhones, iPods, and iPads) open the system to possible compromise via exfiltration of system data. Disabling the usbmuxd daemon blocks connections to iOS devices.",
|
|
1238
|
+
"severity": "medium"
|
|
1239
|
+
}
|
|
1240
|
+
]
|
|
1241
|
+
}
|