CCI-000770

The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

33 rules found Severity: Medium

31 rules found Severity: Medium

5 rules found Severity: Medium

8 rules found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: High

2 rules found Severity: Medium

4 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Low

2 rules found Severity: Low

3 rules found Severity: Medium

CCI-000770

Ensure All Accounts on the System Have Unique Names

Restrict Serial Port Root Logins

Restrict Virtual Console Root Logins

Enable Smart Card Login

Disable SSH Root Login

Direct root Logins Are Not Allowed

SAML integration must be enabled in Docker Enterprise.

The WebSphere Application Server users in a local user registry group must be authorized for that group.

Oracle WebLogic must authenticate users individually prior to using a group authenticator.

The macOS system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

The Ubuntu operating system must prevent direct login into the root account.

The network device must be configured to authenticate each administrator prior to authorizing privileges based on assignment of group or role.

The BIG-IP appliance must be configured to ensure administrators are authenticated with an individual authenticator prior to using a group authenticator.

TLS must be enabled on JMX.

The F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins.

Direct logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.

The JBoss server must be configured to use individual accounts and not generic or shared accounts.

MKE must be configured to integrate with an Enterprise Identity Provider.

ONTAP must be configured to authenticate each administrator prior to authorizing privileges based on assignment of group or role.

The Oracle Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.

The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.

SLEM 5 must deny direct logons to the root account using remote access via SSH.

The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.

The macOS system must disable logon to other user's active and locked sessions.

The macOS system must disable root logon.

The macOS system must disable root logon for SSH.

The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.

Ubuntu 22.04 LTS must prevent direct login into the root account.

AOS must be configured to use DOD public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.

OL 8 must not permit direct logons to the root account using remote access via SSH.

Prisma Cloud Compute must be configured with unique user accounts.

OpenShift RBAC access controls must be enforced.

RHEL 8 must not permit direct logons to the root account using remote access via SSH.

RHEL 9 must not permit direct logons to the root account using remote access via SSH.

RHEL 9 must use the common access card (CAC) smart card driver.

The SUSE operating system must deny direct logons to the root account using remote access via SSH.

The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

The ESXi host must use Active Directory for local user authentication.

The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.

The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.