CCI-000187
For public key-based authentication, map the authenticated identity to the account of the individual or group.
1 rule found Severity: High
The CA API Gateway providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
1 rule found Severity: Medium
The HP FlexFabric Switch must map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: Medium
The DataPower Gateway must map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: Medium
The DataPower Gateway providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
1 rule found Severity: Medium
The MQ Appliance messaging server must map the authenticated identity to the individual messaging user or group account for PKI-based authentication.
1 rule found Severity: Medium
WebGUI access to the MQ Appliance network device must map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: Medium
The WebSphere Application Server multifactor authentication for network access to privileged accounts must be used.
1 rule found Severity: Medium
The WebSphere Application Server must authenticate all network-connected endpoint devices before establishing any connection.
1 rule found Severity: Medium
1 rule found Severity: Medium
MobileIron Sentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
The Sentry providing PKI-based mobile device authentication intermediary services must map authenticated identities to the mobile device account.
2 rules found Severity: Medium
Firefox must be configured to ask which certificate to present to a website when a certificate is required.
1 rule found Severity: Medium
Nutanix AOS must accept Personal Identity Verification (PIV) credentials to access the management interface.
1 rule found Severity: Medium
1 rule found Severity: Medium
Innoslate must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: High
Symantec ProxySG, when configured for reverse proxy/WAF services and providing PKI-based user authentication intermediary services, must map the client certificate to the authentication server store.
1 rule found Severity: Medium
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
2 rules found Severity: Medium
The Tanium application must be configured for LDAP user/group synchronization to map the authenticated identity to the individual user or group account for PKI-based authentication.
3 rules found Severity: Medium
The NSX-T Manager must integrate with either VMware Identity Manager (vIDM) or VMware Workspace ONE Access.
1 rule found Severity: High
The macOS system must use multifactor authentication for local access to privileged and non-privileged accounts.
1 rule found Severity: High
The Ubuntu operating system must map the authenticated identity to the user or group account for PKI-based authentication.
2 rules found Severity: High
3 rules found Severity: Medium
The DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account.
1 rule found Severity: Medium
Processes (services, applications, etc.) that connect to the DBMS independently of individual users, must use valid, current DoD-issued PKI certificates for authentication to the DBMS.
1 rule found Severity: Medium
3 rules found Severity: Medium
The BIG-IP APM module must map the authenticated identity to the user account for PKI-based authentication to virtual servers.
1 rule found Severity: Medium
The BIG-IP Core implementation providing PKI-based, user authentication intermediary services must be configured to map the authenticated identity to the user account for PKI-based authentication to virtual servers.
1 rule found Severity: Medium
The macOS system must use multifactor authentication for local access to privileged and nonprivileged accounts.
1 rule found Severity: High
The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.
1 rule found Severity: Medium
The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client’s certificate to entries in the authentication server to determine authorization to access the network.
1 rule found Severity: Medium
2 rules found Severity: Medium
The F5 BIG-IP appliance providing user authentication intermediary services must uniquely identify and authenticate users using redundant authentication servers and multifactor authentication (MFA).
1 rule found Severity: High
The F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins.
1 rule found Severity: High
The HPE 3PAR OS must map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
Sentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The network device, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
The MySQL Database Server 8.0 must map the PKI-authenticated identity to an associated user account.
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
SLEM 5 must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).
1 rule found Severity: Medium
1 rule found Severity: Medium
NixOS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
1 rule found Severity: Medium
AAA Services must be configured to map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: Medium
The ALG providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
1 rule found Severity: Medium
The application server must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Medium
The application must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: High
The Central Log Server must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Low
AlmaLinux OS 9 must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: Medium
The container platform must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Medium
The Dell OS10 Switch, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
Dragos Platform must accept the DOD CAC or other PKI credential for identity management and personal authentication.
1 rule found Severity: Medium
The operating system must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: Medium
AOS must be configured to use DOD public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.
1 rule found Severity: High
The HYCU virtual appliance must be configured to use DOD-approved online certificate status protocol (OCSP) responders or certificate revocation lists (CRLs) to validate certificates used for PKI-based authentication.
1 rule found Severity: High
The Remote Access VPN Gateway must use a separate authentication server (e.g., Lightweight Directory Access Protocol [LDAP], Remote Authentication Dial-In User Service [RADIUS], Terminal Access Controller Access-Control System+ [TACACS+] to perform user authentication.
1 rule found Severity: Medium
The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: Medium
The Mainframe Product must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Medium
1 rule found Severity: Medium
Prisma Cloud Compute must be configured to require local user accounts to use x.509 multifactor authentication.
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 8 must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: Medium
RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: Medium
The SUSE operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).
2 rules found Severity: Medium
The VMM must map the authenticated identity to the user or group account for PKI-based authentication.
1 rule found Severity: Medium
The UEM server must map the authenticated identity to the individual user or group account for PKI-based authentication.
1 rule found Severity: Medium
The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.
1 rule found Severity: Medium
The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.
1 rule found Severity: Medium
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High