Skip to content
Log In

CCI-001082

Separate user functionality, including user interface services, from system management functionality.

DB2 must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

The WebSphere Application Servers must not be in the DMZ.

1 rule found Severity: Medium

Logo

CA VM:Secure product ADMIN GLOBALS command must be restricted to systems programming personnel.

1 rule found Severity: Medium

Logo

Exchange Mailbox databases must reside on a dedicated partition.

3 rules found Severity: Medium

Logo

SQL Server must be configured to separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

Nutanix AOS must separate hosted application functionality from application server management functionality.

1 rule found Severity: Medium

Logo

Nutanix AOS must configure network traffic segmentation when using Disaster Recovery Services.

1 rule found Severity: Medium

Logo

OHS accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

1 rule found Severity: High

Logo

Oracle WebLogic must separate hosted application functionality from Oracle WebLogic management functionality.

1 rule found Severity: Medium

Logo

The Tanium Module server must be installed on a separate system.

2 rules found Severity: Medium

Logo

The Tanium application must separate user functionality (including user interface services) from information system management functionality.

3 rules found Severity: Medium

Logo

MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

2 rules found Severity: Medium

Logo

The DBMS must separate user functionality (including user interface services) from database management functionality.

3 rules found Severity: Medium

Logo

PostgreSQL must separate user functionality (including user interface services) from database management functionality.

3 rules found Severity: Medium

Logo

The EDB Postgres Advanced Server must separate user functionality (including user interface services) from database management functionality.

2 rules found Severity: Medium

Logo

Access to JMX management interface must be restricted.

1 rule found Severity: Medium

Logo

Access to Tomcat manager application must be restricted.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS USER-level tasks must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS DEVELOPER-level tasks must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS DBADMIN-level tasks must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS DCADMIN-level tasks must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS User-level programs must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS Developer-level Programs must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS Database-Administrator-level programs must be properly secured.

1 rule found Severity: Medium

Logo

All installation-delivered IDMS DC-Administrator-level programs must be properly secured.

1 rule found Severity: Medium

Logo

SSMC web server application, libraries, and configuration files must only be accessible to privileged users.

1 rule found Severity: Medium

Logo

The JBoss server must separate hosted application functionality from application server management functionality.

1 rule found Severity: Medium

Logo

Kubernetes must separate user functionality.

1 rule found Severity: Medium

Logo

MarkLogic Server must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

MongoDB must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

Azure SQL Database must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

IIS 10.0 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

1 rule found Severity: High

Logo

The IIS 10.0 web server must separate the hosted applications from hosted web server management functionality.

1 rule found Severity: Medium

Logo

Anonymous IIS 10.0 website access accounts must be restricted.

1 rule found Severity: High

Logo

A Windows PAW used to manage domain controllers and directory services must not be used to manage any other type of high-value IT resource.

1 rule found Severity: High

Logo

In a Windows PAW, administrator accounts used for maintaining the PAW must be separate from administrative accounts used to manage high-value IT resources.

1 rule found Severity: Medium

Logo

The MySQL Database Server 8.0 must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

Redis Enterprise DBMS must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

Access to the Redis Enterprise control plane must be restricted.

1 rule found Severity: High

Logo

All Automation Controller NGINX web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

1 rule found Severity: Medium

Logo

Nonprivileged accounts on the hosting system must only access Automation Controller NGINX web server security-relevant information and functions through a distinct administrative account.

1 rule found Severity: Medium

Logo

The SDN controller must be configured to separate tenant functionality from system management functionality.

1 rule found Severity: Medium

Logo

Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

1 rule found Severity: Medium

Logo

Anonymous user access to the web server application directories must be prohibited.

1 rule found Severity: Medium

Logo

The web server must separate the hosted applications from hosted web server management functionality.

1 rule found Severity: Medium

Logo

Restrict Access to Kernel Message Buffer

17 rules found Severity: Low

Logo

Disallow kernel profiling by unprivileged users

13 rules found Severity: Low

Logo

Disable Access to Network bpf() Syscall From Unprivileged Processes

10 rules found Severity: Medium

Logo

Restrict usage of ptrace to descendant processes

13 rules found Severity: Medium

Logo

Restrict Exposed Kernel Pointer Addresses Access

26 rules found Severity: Medium

Logo

NixOS must implement nonexecutable data to protect its memory from unauthorized code execution.

1 rule found Severity: Medium

Logo

Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

3 rules found Severity: Medium

Logo

Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.

2 rules found Severity: High

Logo

The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

3 rules found Severity: Medium

Logo

Anonymous user access to the Apache web server application directories must be prohibited.

1 rule found Severity: High

Logo

The application server must separate hosted application functionality from application server management functionality.

1 rule found Severity: Medium

Logo

The application user interface must be either physically or logically separated from data storage and management interfaces.

1 rule found Severity: Medium

Logo

AlmaLinux OS 9 must disable access to network bpf system call from nonprivileged processes.

1 rule found Severity: Medium

Logo

AlmaLinux OS 9 must restrict exposed kernel pointer addresses access.

1 rule found Severity: Medium

Logo

AlmaLinux OS 9 must restrict usage of ptrace to descendant processes.

1 rule found Severity: Medium

Logo

AlmaLinux OS 9 must restrict access to the kernel message buffer.

1 rule found Severity: Medium

Logo

AlmaLinux OS 9 must prevent kernel profiling by nonprivileged users.

1 rule found Severity: Medium

Logo

The container platform must separate user functionality (including user interface services) from information system management functionality.

1 rule found Severity: Medium

Logo

The operating system must separate user functionality (including user interface services) from operating system management functionality.

1 rule found Severity: Medium

Logo

Access to IBM Security zSecure program resources must be limited to authorized users.

1 rule found Severity: Medium

Logo

The Mainframe Product must separate user functionality (including user interface services) from information system management functionality.

1 rule found Severity: Medium

Logo

MariaDB must separate user functionality (including user interface services) from database management functionality.

1 rule found Severity: Medium

Logo

Exchange queue database must reside on a dedicated partition.

1 rule found Severity: Medium

Logo

Users requiring access to Prisma Cloud Compute's Credential Store must be assigned and accessed by the appropriate role holders.

1 rule found Severity: Medium

Logo

Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources.

1 rule found Severity: Medium

Logo

OpenShift must separate user functionality (including user interface services) from information system management functionality.

1 rule found Severity: Medium

Logo

RHEL 9 must restrict access to the kernel message buffer.

1 rule found Severity: Medium

Logo

RHEL 9 must prevent kernel profiling by nonprivileged users.

1 rule found Severity: Medium

Logo

RHEL 9 must restrict exposed kernel pointer addresses access.

1 rule found Severity: Medium

Logo

RHEL 9 must disable access to network bpf system call from nonprivileged processes.

1 rule found Severity: Medium

Logo

RHEL 9 must restrict usage of ptrace to descendant processes.

1 rule found Severity: Medium

Logo

The VMM must separate user functionality (including user interface services) from VMM management functionality.

1 rule found Severity: Medium

Logo

ESX Agent Manager directory tree must have permissions in an out-of-the-box state.

1 rule found Severity: Medium

Logo

VAMI server binaries and libraries must be verified for their integrity.

1 rule found Severity: Medium

Logo

Lookup Service directory tree must have permissions in an out-of-the-box state.

1 rule found Severity: Medium

Logo

Performance Charts directory tree must have permissions in an out-of-the-box state.

1 rule found Severity: Medium

Logo

The vCenter Server user roles must be verified.

2 rules found Severity: Medium

Logo

The Security Token Service directory tree must have permissions in an out-of-the-box state.

1 rule found Severity: Medium

Logo

The vSphere UI directory tree must have permissions in an out-of-the-box state.

1 rule found Severity: Medium

Logo

The vCenter Server users must have the correct roles assigned.

1 rule found Severity: Medium

Logo