CCI-000382
Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
The A10 Networks ADC must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The A10 Networks ADC must disable management protocol access to all interfaces except the management interface.
1 rule found Severity: Medium
Compliance Guardian must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
Compliance Guardian must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Arista Multilayer Switch must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
DocAve must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
The firewall protecting the BlackBerry UEM server platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support BlackBerry UEM server and platform functions.
1 rule found Severity: Medium
The firewall protecting the BlackBerry UEM server platform must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services).
1 rule found Severity: Medium
The BlackBerry UEM server Blackberry Web Services must not be authorized access from external sources unnecessarily.
1 rule found Severity: Medium
The BlackBerry Enterprise Mobility Server (BEMS) platform must be protected by a DoD-approved firewall.
1 rule found Severity: Medium
The firewall protecting the BlackBerry Enterprise Mobility Server (BEMS) must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support BEMS functions.
1 rule found Severity: Medium
The firewall protecting the BlackBerry Enterprise Mobility Server (BEMS) must be configured so that only DoD-approved ports, protocols, and services are enabled. See the DoD Ports, Protocols, Services Management (PPSM) Category Assurance Levels (CAL) list for DoD-approved ports, protocols, and services.
1 rule found Severity: Medium
The BlackBerry Enterprise Mobility Server (BEMS) platform must be protected by a DOD-approved firewall.
1 rule found Severity: Medium
The firewall protecting the BEMS must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support BEMS functions.
1 rule found Severity: Medium
The firewall protecting the BlackBerry Enterprise Mobility Server (BEMS) must be configured so that only DOD-approved ports, protocols, and services are enabled.
1 rule found Severity: Medium
The CA API Gateway must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Citrix Linux Virtual Delivery Agent (LVDA) must be configured to prohibit or restrict the use of ports, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Citrix Windows Virtual Delivery Agent must be configured to prohibit or restrict the use of ports, as defined in the PPSM CAL and vulnerability assessments.
2 rules found Severity: Medium
TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The FortiGate device must prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.
1 rule found Severity: High
The HP FlexFabric Switch must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
1 rule found Severity: High
The network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
5 rules found Severity: High
1 rule found Severity: Medium
The DataPower Gateway must have SSH and web management bound to the management interface and Telnet disabled.
1 rule found Severity: Medium
DB2 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The IBM Aspera Console must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
IBM Aspera Faspex must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
IBM Aspera Shares must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The IBM Aspera High-Speed Transfer Endpoint must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The IBM Aspera High-Speed Transfer Server must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
The IBM Aspera High-Speed Transfer Server must restrict Aspera transfer users to a limited part of the server's file system.
1 rule found Severity: Medium
1 rule found Severity: Medium
The DataPower Gateway must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
The firewall protecting the MaaS360 server platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support MaaS360 server and platform functions.
1 rule found Severity: Medium
The firewall protecting the MaaS360 server platform must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services.)
1 rule found Severity: Medium
The WebSphere Application Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
All IBM z/VM TCP/IP Ports must be restricted to ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Infoblox systems configured to run the DNS service must be configured to prohibit or restrict unapproved ports and protocols.
1 rule found Severity: Medium
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 EMM Suite must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are Government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
The Sentry must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
2 rules found Severity: Medium
The firewall protecting the MDM server platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support MDM server and platform functions.
1 rule found Severity: Medium
The firewall protecting the MDM server platform must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services.)
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Windows 2012 DNS Server must be configured to prohibit or restrict unapproved ports and protocols.
1 rule found Severity: Medium
The MFD must be configured to prohibit the use of all unnecessary and/or nonsecure functions, physical and logical ports, protocols, and/or services.
1 rule found Severity: Medium
Nutanix AOS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
Oracle WebLogic must support the capability to disable network protocols deemed by the organization to be non-secure except for explicitly identified components in support of specific operational requirements.
1 rule found Severity: Medium
Oracle WebLogic must prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.
1 rule found Severity: Medium
The Riverbed Optimization System (RiOS) must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Innoslate must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
1 rule found Severity: Medium
The firewall protecting the Samsung SDS EMM platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support Samsung SDS EMM and platform functions.
1 rule found Severity: Medium
The firewall protecting the Samsung SDS EMM platform must be configured so that only DoD-approved ports, protocols, and services are enabled. See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services.
1 rule found Severity: Medium
Symantec ProxySG must be configured to prohibit or restrict the use of network services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: High
4 rules found Severity: Medium
4 rules found Severity: Medium
Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.
5 rules found Severity: Medium
The Tanium Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The firewall protecting the Workspace ONE UEM server must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support MDM server and platform functions.
1 rule found Severity: Medium
The firewall protecting the Workspace ONE UEM server must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services).
1 rule found Severity: Medium
The DOD Mobile Service Provider must not allow BYOADs in facilities where personally owned mobile devices are prohibited.
2 rules found Severity: Medium
The iOS/iPadOS 16 BYOAD must be configured to disable device cameras and/or microphones when brought into DOD facilities where mobile phone cameras and/or microphones are prohibited.
1 rule found Severity: Medium
2 rules found Severity: Medium
The Ubuntu operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
2 rules found Severity: Medium
Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.
3 rules found Severity: Medium
Windows Defender Firewall with Advanced Security must block unsolicited inbound connections when connected to a domain.
1 rule found Severity: High
Windows Defender Firewall with Advanced Security must block unsolicited inbound connections when connected to a private network.
1 rule found Severity: High
Windows Defender Firewall with Advanced Security must block unsolicited inbound connections when connected to a public network.
1 rule found Severity: High
The DBMS must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.
2 rules found Severity: Medium
The DBMS must support the disabling of network protocols deemed by the organization to be non-secure.
1 rule found Severity: Medium
PostgreSQL must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
3 rules found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.
1 rule found Severity: Medium
The EDB Postgres Advanced Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
2 rules found Severity: Medium
The BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The BIG-IP Core implementation must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocol, and Service Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The iOS/iPadOS 17 BYOAD must be configured to disable device cameras and/or microphones when brought into DOD facilities where mobile phone cameras and/or microphones are prohibited.
1 rule found Severity: Medium
The Arista network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The Cisco ASA must be configured to prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.
1 rule found Severity: High
The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations.
1 rule found Severity: Medium
The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services.
2 rules found Severity: High
The Cisco router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.
1 rule found Severity: High
The Cisco ISE must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
1 rule found Severity: High
The DNS server implementation must be configured to prohibit or restrict unapproved ports and protocols.
1 rule found Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to only use ports, protocols, and services allowed per the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessments (VAs).
1 rule found Severity: High
The F5 BIG-IP appliance must be configured to prohibit or restrict the use of unnecessary or prohibited functions, ports, protocols, and/or services, including those defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Session Manager must only use ports, protocols, and services allowed per the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessments (VAs).
1 rule found Severity: High
The F5 BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
1 rule found Severity: Medium
The DOD Mobile Service Provider must not allow Google Android 13 BYOADs in facilities where personally owned mobile devices are prohibited.
1 rule found Severity: Medium
The Google Android 13 BYOAD must be configured to disable device cameras and/or microphones when brought into DOD facilities where mobile phone cameras and/or microphones are prohibited.
1 rule found Severity: Medium
The DOD Mobile Service Provider must not allow Google Android 14 BYOADs in facilities where personally owned mobile devices are prohibited.
1 rule found Severity: Medium
The Google Android 14 BYOAD must be configured to disable device cameras and/or microphones when brought into DOD facilities where mobile phone cameras and/or microphones are prohibited.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
HPE Alletra 5000/6000 must be configured to disable management by "HPE Greenlake: Data Services Cloud Console".
1 rule found Severity: Medium
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
1 rule found Severity: High
The HPE 3PAR OS CIMserver process must be configured to use approved encryption and communications protocols to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The HPE 3PAR OS WSAPI process must be configured to use approved encryption and communications protocols to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The WebSphere Liberty Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
1 rule found Severity: Medium
The Juniper EX switch must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
1 rule found Severity: Medium
The firewall protecting the Jamf Pro EMM server platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support Jamf Pro EMM server and platform functions.
1 rule found Severity: Medium
The firewall protecting the Jamf Pro EMM server platform must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services).
1 rule found Severity: Medium
1 rule found Severity: Medium
The Kubernetes API Server must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
1 rule found Severity: Medium
The Kubernetes Scheduler must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
1 rule found Severity: Medium
The Kubernetes Controllers must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
1 rule found Severity: Medium
The Kubernetes etcd must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
1 rule found Severity: Medium
1 rule found Severity: Medium
MarkLogic Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Azure SQL Database must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
2 rules found Severity: Medium
The network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services
1 rule found Severity: High
ONTAP must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.
1 rule found Severity: Medium
The MySQL Database Server 8.0 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: Medium
Redis Enterprise DBMS must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Rancher MCM must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithms for transmission.
1 rule found Severity: High
Automation Controller must use encryption strength in accordance with the categorization of the management data during remote access management sessions.
1 rule found Severity: Medium
All Automation Controller NGINX web servers must be configured to use a specified IP address and port.
1 rule found Severity: Medium
SLEM 5 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The DOD Mobile Service Provider must not allow Samsung Android 14 BYOADs in facilities where personally owned mobile devices are prohibited.
1 rule found Severity: Medium
The Samsung Android 14 BYOAD must be configured to disable device cameras and/or microphones when brought into DOD facilities where mobile phone cameras and/or microphones are prohibited.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM Category Assurance List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The TippingPoint SMS must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
TOSS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
AAA Services must be configured to use protocols that encrypt credentials when authenticating clients, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: High
AAA Services must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
4 rules found Severity: Medium
The ALG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The application server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Cisco router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.
2 rules found Severity: High
The Cisco switch must be configured to prohibit the use of all unnecessary and non-secure functions and services.
1 rule found Severity: High
The Mission Owner must configure the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) to prohibit or restrict the use of functions, ports, protocols, and/or services.
1 rule found Severity: Medium
The container platform runtime must enforce ports, protocols, and services that adhere to the PPSM CAL.
1 rule found Severity: Medium
1 rule found Severity: Medium
The container platform must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithms for transmission.
1 rule found Severity: High
The DBMS must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
The Dell OS10 Switch must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
1 rule found Severity: High
The operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
AOS must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
The HYCU virtual appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.
1 rule found Severity: High
For site-to-site VPN implementations using AOS, the Layer 2 Tunneling Protocol (L2TP) must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.
1 rule found Severity: Medium
The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).
1 rule found Severity: Medium
AOS, when used as an IPsec VPN Gateway, must use Internet Key Exchange (IKE) for IPsec VPN security associations (SAs).
1 rule found Severity: High
The IDPS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf must be properly specified.
3 rules found Severity: Medium
The Juniper router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.
1 rule found Severity: High
2 rules found Severity: Medium
The Juniper SRX Services Gateway Firewall must be configured to prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services, as defined in the PPSM CAL, vulnerability assessments.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must be configured to prohibit the use of unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
For nonlocal maintenance sessions, the Juniper SRX Services Gateway must remove or explicitly deny the use of nonsecure protocols.
1 rule found Severity: Medium
1 rule found Severity: High
The Juniper SRX Services Gateway must ensure SSH is disabled for root user logon to prevent remote access using the root account.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must ensure access to start a UNIX-level shell is restricted to only the root account.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must ensure TCP forwarding is disabled for SSH to prevent unauthorized access.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must be configured with only one local user account to be used as the account of last resort.
1 rule found Severity: Medium
For nonlocal maintenance sessions, the Juniper SRX Services Gateway must explicitly deny the use of J-Web.
1 rule found Severity: High
MariaDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
When configuring SharePoint Central Administration, the port number selected must comply with DoD Ports and Protocol Management (PPSM) program requirements.
1 rule found Severity: Medium
SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Windows Server 2019 must not have the Microsoft FTP service installed unless required by the organization.
1 rule found Severity: Medium
Windows Server 2022 must not have the Microsoft FTP service installed unless required by the organization.
1 rule found Severity: Medium
The DBMS must support the disabling of network protocols deemed by the organization to be nonsecure.
1 rule found Severity: Medium
Prisma Cloud Compute Console must use TLS 1.2 for user interface and API access. Communication TCP ports must adhere to the Ports, Protocols, and Services Management Category Assurance Levels (PSSM CAL).
1 rule found Severity: High
The Palo Alto Networks security platform must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
OL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The Palo Alto Networks security platform must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
RHEL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
1 rule found Severity: Medium
The SUSE operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
2 rules found Severity: Medium
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
2 rules found Severity: Medium
The firewall protecting the UEM server platform must be configured so only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services).
1 rule found Severity: Medium
1 rule found Severity: Medium
The VMM must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
2 rules found Severity: Medium
The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.
1 rule found Severity: Medium
For site-to-site VPN implementations, the L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.
1 rule found Severity: Medium
The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.
3 rules found Severity: Medium