CCI-000764
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
The A10 Networks ADC must not have any shared accounts (other than the emergency administration account).
1 rule found Severity: Medium
All BlackBerry UEM server local accounts created during application installation and configuration must be disabled or removed.
1 rule found Severity: Medium
The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use Windows Authentication for the database connection.
2 rules found Severity: Medium
If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.
2 rules found Severity: Medium
If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Integrated Authentication for the Exchange connection.
2 rules found Severity: Medium
If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.
2 rules found Severity: Medium
If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.
2 rules found Severity: Medium
If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use NTLM authentication.
2 rules found Severity: Medium
The CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The CA API Gateway providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) that validate user account access authorizations and privileges.
1 rule found Severity: Medium
The CA API Gateway providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
1 rule found Severity: Medium
If user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
1 rule found Severity: Medium
If user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
1 rule found Severity: Medium
The storage system must only be operated in conjunction with an LDAP server in a trusted environment if an Active Directory server is not available.
1 rule found Severity: High
The storage system must only be operated in conjunction with an Active Directory server in a trusted environment if an LDAP server is not available.
1 rule found Severity: High
IBM Aspera Console must be configured with a preestablished trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
1 rule found Severity: Medium
IBM Aspera Faspex must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
IBM Aspera Shares must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: Medium
The DataPower Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The DataPower Gateway providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
1 rule found Severity: Medium
The DataPower Gateway providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
1 rule found Severity: Medium
The MQ Appliance messaging server must use an enterprise user management system to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The MQ Appliance network device must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
MobileIron Sentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
ISEC7 EMM Suite must disable or delete local account created during application installation and configuration.
1 rule found Severity: High
The Sentry providing mobile device access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate mobile device account access authorizations and privileges.
2 rules found Severity: Medium
The Sentry providing mobile device authentication intermediary services must restrict mobile device authentication traffic to specific authentication server(s).
2 rules found Severity: Medium
SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
2 rules found Severity: Medium
Nutanix AOS must use an enterprise user management system to uniquely identify and authenticate users.
1 rule found Severity: Medium
Oracle WebLogic must uniquely identify and authenticate users (or processes acting on behalf of users).
1 rule found Severity: High
Symantec ProxySG must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: High
Symantec ProxySG must be configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate user account access authorizations and privileges.
1 rule found Severity: High
Symantec ProxySG providing user authentication intermediary services must restrict user authentication traffic to specific authentication servers.
1 rule found Severity: High
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
2 rules found Severity: Medium
Multi-factor authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
1 rule found Severity: Medium
The NSX-T Manager must integrate with either VMware Identity Manager (vIDM) or VMware Workspace ONE Access.
1 rule found Severity: High
All Workspace ONE UEM server local accounts created during application installation and configuration must be disabled or removed.
1 rule found Severity: Medium
2 rules found Severity: Medium
Apple iOS/iPadOS 16 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 16 Mail app.
2 rules found Severity: Medium
2 rules found Severity: Medium
MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
3 rules found Severity: Medium
The DBMS must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
3 rules found Severity: Medium
The DBMS must ensure users are authenticated with an individual authenticator prior to using a group authenticator.
1 rule found Severity: Medium
PostgreSQL must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
3 rules found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.
1 rule found Severity: Low
The EDB Postgres Advanced Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
2 rules found Severity: Medium
The BIG-IP APM module must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.
1 rule found Severity: Medium
The BIG-IP APM module must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or authentication, authorization, and accounting (AAA) server) that validate user account access authorizations and privileges when providing access control to virtual servers.
1 rule found Severity: Medium
The BIG-IP APM module must restrict user authentication traffic to specific authentication server(s) when providing user authentication to virtual servers.
1 rule found Severity: Medium
The BIG-IP appliance must be configured to uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
1 rule found Severity: High
The BIG-IP Core implementation must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.
1 rule found Severity: Medium
The BIG-IP Core implementation must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or authentication, authorization, and accounting (AAA) server) that validate user account access authorizations and privileges when providing access control to virtual servers.
1 rule found Severity: Medium
The BIG-IP Core implementation providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s) when providing access control to virtual servers.
1 rule found Severity: Medium
2 rules found Severity: Medium
Apple iOS/iPadOS 17 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 17 Mail app.
2 rules found Severity: Medium
1 rule found Severity: Medium
The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.
1 rule found Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to uniquely identify participating users.
1 rule found Severity: High
The F5 BIG-IP appliance providing user authentication intermediary services must uniquely identify and authenticate users using redundant authentication servers and multifactor authentication (MFA).
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Session Manager must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Session Manager must be configured to use an organizational-level user account management system.
1 rule found Severity: High
The F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins.
1 rule found Severity: High
1 rule found Severity: Medium
The HPE 3PAR OS must provide automated mechanisms for supporting account management functions via AD.
1 rule found Severity: Medium
All accounts on AIX must be assigned unique User Identification Numbers (UIDs) and must authenticate organizational and non-organizational users (or processes acting on behalf of these users).
1 rule found Severity: High
1 rule found Severity: Medium
ISEC7 SPHERE must disable or delete local account created during application installation and configuration.
1 rule found Severity: High
1 rule found Severity: High
The ICS must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
Sentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
All Jamf Pro EMM server local accounts created during application installation and configuration must be disabled.
1 rule found Severity: Medium
The JBoss Server must be configured to utilize a centralized authentication mechanism such as AD or LDAP.
1 rule found Severity: Medium
MarkLogic Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: Medium
Azure SQL Database must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The network device, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
The Oracle Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.
1 rule found Severity: Medium
The Oracle Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.
1 rule found Severity: Low
The MySQL Database Server 8.0 must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
1 rule found Severity: High
Redis Enterprise DBMS must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: Medium
Splunk Enterprise must use organization level authentication to uniquely identify and authenticate users.
1 rule found Severity: High
Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.
1 rule found Severity: High
Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.
1 rule found Severity: High
Multifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
2 rules found Severity: Medium
Security identifiers (SIDs) must be configured to use only authentication data of directly trusted external or forest trust.
1 rule found Severity: Medium
NixOS must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
Apple iOS/iPadOS 18 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 18 Mail app.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
The ALG providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The ALG providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
1 rule found Severity: Medium
The ALG providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
1 rule found Severity: Medium
1 rule found Severity: Medium
The application server must use an approved DOD enterprise identity, credential, and access management (ICAM) solution to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: High
The Central Log Server must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: High
The cloud service offering (CSO) must be configured to use DOD public key infrastructure (PKI) to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The container platform application program interface (API) must uniquely identify and authenticate users.
1 rule found Severity: Medium
The container platform must uniquely identify and authenticate processes acting on behalf of the users.
1 rule found Severity: Medium
The container platform application program interface (API) must uniquely identify and authenticate processes acting on behalf of the users.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Dell OS10 Switch, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
1 rule found Severity: High
The operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
AOS must be configured to use DOD public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.
1 rule found Severity: High
The HYCU virtual appliance must be configured to use DOD-approved online certificate status protocol (OCSP) responders or certificate revocation lists (CRLs) to validate certificates used for PKI-based authentication.
1 rule found Severity: High
The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
2 rules found Severity: Medium
IBM z/OS Certificate Name Filtering must be implemented with appropriate authorization and documentation.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM z/OS Started tasks for the Base TCP/IP component must be defined in accordance with security requirements.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM z/OS Attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.
1 rule found Severity: Medium
IBM Integrated Crypto Service Facility (ICSF) Started Task name must be properly identified / defined to the system ACP.
1 rule found Severity: Medium
2 rules found Severity: Medium
The IBM z/OS user account for the UNIX kernel (OMVS) must be properly defined to the security database.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
IBM z/OS attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.
2 rules found Severity: Medium
IBM Integrated Crypto Service Facility (ICSF) Started Task name is not properly identified / defined to the system ACP.
2 rules found Severity: Medium
IBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the STARTED resource class for RACF.
1 rule found Severity: Medium
IBM z/OS must have Certificate Name Filtering implemented with appropriate authorization and documentation.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Low
1 rule found Severity: Medium
IBM z/OS started tasks for the Base TCP/IP component must be defined in accordance with security requirements.
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
The Mainframe Product must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
MariaDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The DBMS must ensure users are authenticated with an individual authenticator prior to using a shared authenticator.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Palo Alto Networks security platform must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The UEM server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
The VMM must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users).
1 rule found Severity: Medium
ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.
1 rule found Severity: Medium
Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.
1 rule found Severity: Medium
The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.
2 rules found Severity: Low
The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.
3 rules found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
BMC Mainview for z/OS Started Task name must be properly identified and/or defined to the system ACP.
1 rule found Severity: Medium
CA 1 Tape Management Started Task name will be properly identified and/or defined to the system ACP.
3 rules found Severity: Medium
3 rules found Severity: Medium
CA MIM Resource Sharing Started Task name will be properly identified and/or defined to the system ACP.
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.
2 rules found Severity: Medium
CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.
3 rules found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
3 rules found Severity: Medium
Tivoli Asset Discovery for z/OS (TADz) Started Task name(s) must be properly identified / defined to the system ACP.
3 rules found Severity: Medium
BMC Mainview for z/OS Started Task name is not properly identified and/or defined to the system ACP.
2 rules found Severity: Medium
BMC Mainview for z/OS Started task(s) must be properly defined to the STARTED resource class for RACF.
1 rule found Severity: Medium
1 rule found Severity: High
3 rules found Severity: Medium
3 rules found Severity: Medium
BMC CONTROL-D Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM System Display and Search Facility (SDSF) Started Task name will be properly identified and/or defined to the system ACP.
3 rules found Severity: Medium
1 rule found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
CA MIM Resource Sharing Started task will be properly defined to the STARTED resource class for RACF.
1 rule found Severity: Medium
1 rule found Severity: Medium
BMC CONTROL-M Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
BMC CONTROL-O Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
BMC Mainview for z/OS Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
CA Common Services Started task will be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
CA MIM Resource Sharing Started task will be properly defined to the Started Task Table for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
CL/SuperSession Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM Tivoli Asset Discovery for zOS (TADz) Started task(s) must be properly defined to the STARTED resource class for RACF.
1 rule found Severity: Medium
1 rule found Severity: Medium
CA 1 Tape Management Started task will be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.
1 rule found Severity: Medium
IBM System Display and Search Facility (SDSF) Started task will be properly defined to the STARTED resource class for RACF.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM System Display and Search Facility (SDSF) Started task will be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM Tivoli NetView Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM Tivoli Asset Discovery for zOS (TADz) Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.
1 rule found Severity: Medium
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High