CCI-001084
Isolate security functions from nonsecurity functions.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OHS must have the Directory directive accompanying the DocumentRoot directive set to a separate partition from the OHS system files.
1 rule found Severity: Medium
The Tanium Server must be configured with a connector to sync to Microsoft Active Directory for account management functions, must isolate security functions from non-security functions, and must terminate shared/group account credentials when members leave the group.
1 rule found Severity: Medium
The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions.
4 rules found Severity: Medium
3 rules found Severity: Medium
The Ubuntu operating system must be configured so that only users who need access to security functions are part of the sudo group.
1 rule found Severity: High
MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
1 rule found Severity: Medium
The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The DBMS must isolate security functions from non-security functions by means of separate security domains.
1 rule found Severity: Medium
Administrators must utilize a separate, distinct administrative account when performing administrative activities, accessing database security functions, or accessing security-relevant information.
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
CA IDMS must isolate the security manager to which users, groups, roles are assigned authorities/permissions to resources.
1 rule found Severity: Medium
The Ubuntu operating system must ensure only users who need access to security functions are part of sudo group.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
AIX must turn on enhanced Role-Based Access Control (RBAC) to isolate security functions from nonsecurity functions, to grant system privileges to other operating system admins, and prohibit user installation of system software without explicit privileged status.
1 rule found Severity: Medium
1 rule found Severity: Medium
The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.
1 rule found Severity: Medium
Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
3 rules found Severity: Medium
1 rule found Severity: Medium
User Account Control must be configured to detect application installations and prompt for elevation.
3 rules found Severity: Medium
User Account Control must only elevate UIAccess applications that are installed in secure locations.
3 rules found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Automation Controller NGINX web server document directory must be in a separate partition from the web server's system files.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
The web server document directory must be in a separate partition from the web servers system files.
1 rule found Severity: Medium
The Apache web server document directory must be in a separate partition from the Apache web servers system files.
3 rules found Severity: Medium
1 rule found Severity: Medium
Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.
1 rule found Severity: Medium
Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
1 rule found Severity: Medium
Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
1 rule found Severity: Medium
Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation.
1 rule found Severity: Medium
Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.
1 rule found Severity: Medium
Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.
1 rule found Severity: Medium
The DBMS must isolate security functions from nonsecurity functions by means of separate security domains.
1 rule found Severity: Medium
Windows Server 2022 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
1 rule found Severity: Medium
Windows Server 2022 User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop.
1 rule found Severity: Medium
Windows Server 2022 User Account Control (UAC) must be configured to detect application installations and prompt for elevation.
1 rule found Severity: Medium
Windows Server 2022 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.
1 rule found Severity: Medium
Windows Server 2022 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.
1 rule found Severity: Medium
Users requiring access to Prisma Cloud Compute's Credential Store must be assigned and accessed by the appropriate role holders.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium