CCI-001813
Enforce access restrictions using organization-defined mechanisms.
4 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.
1 rule found Severity: Medium
A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set.
1 rule found Severity: Medium
The FortiGate device must enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
The DataPower Gateway must enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
DB2 and the operating system must enforce access restrictions associated with changes to the configuration of DB2 or database(s).
1 rule found Severity: Medium
The WebSphere Application Server users in a local user registry group must be authorized for that group.
1 rule found Severity: Medium
1 rule found Severity: Medium
The ISEC7 EMM Suite must remove any unnecessaryusers or groups that have permissions to the server.xml file in Apache Tomcat.
1 rule found Severity: Medium
SQL Server and Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance or database(s).
1 rule found Severity: Medium
Nutanix AOS must enforce access restrictions associated with changes to application server configuration.
1 rule found Severity: Medium
Tanium must prohibit user installation of software without explicit privileged status and enforce access restrictions associated with changes to application configuration.
1 rule found Severity: Medium
The Tanium application must prohibit user installation of software without explicit privileged status.
1 rule found Severity: Medium
The application must enforce access restrictions associated with changes to application configuration.
4 rules found Severity: Medium
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
3 rules found Severity: Medium
The DBMS must support enforcement of logical access restrictions associated with changes to the DBMS configuration and to the database itself.
2 rules found Severity: Medium
PostgreSQL must enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).
2 rules found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.
1 rule found Severity: High
The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).
2 rules found Severity: Medium
The BIG-IP appliance must be configured to enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
If the Arista network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.
1 rule found Severity: Medium
The commands that allow dynamic definitions of PROGRAM/TASK and the dynamic varying of memory must be secured.
1 rule found Severity: Medium
Database utilities must be secured in CA IDMS and permissions given to appropriate role(s)/groups(s) in the external security manager (ESM).
1 rule found Severity: Medium
The online debugger which can change programs and storage in the CA IDMS address space must be secured.
1 rule found Severity: Medium
1 rule found Severity: Medium
PostgreSQL must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
1 rule found Severity: Medium
SSMC web server application, libraries, and configuration files must only be accessible to privileged users.
1 rule found Severity: Medium
1 rule found Severity: Medium
The ISEC7 SPHERE must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.
1 rule found Severity: Medium
1 rule found Severity: High
The MySQL DatabasePassword key must be removed or set to a blank value in the database configuration file in Jamf Pro EMM.
1 rule found Severity: Medium
The Juniper EX switch must be configured to enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
1 rule found Severity: Medium
Least privilege access and need to know must be required to access MKE runtime and instantiate container images.
1 rule found Severity: High
Azure SQL Database must enforce access restrictions associated with changes to the configuration of the Azure SQL Database server or database(s).
1 rule found Severity: Medium
Access to web administration tools must be restricted to the web manager and the web managers designees.
1 rule found Severity: Medium
The network device must enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Oracle Linux operating system must not allow removable media to be used as the boot loader unless approved.
1 rule found Severity: Medium
The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.
1 rule found Severity: Medium
The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.
1 rule found Severity: Medium
The MySQL Database Server 8.0 must enforce access restrictions associated with changes to the configuration of the MySQL Database Server 8.0 or database(s).
1 rule found Severity: Medium
Redis Enterprise DBMS must enforce access restrictions associated with changes to the configuration of Redis Enterprise DBMS or database(s).
1 rule found Severity: Medium
The Automation Controller NGINX web server application, libraries, and configuration files must only be accessible to privileged users.
1 rule found Severity: Medium
The SDN controller must be configured to enforce access restrictions associated with changes to the configuration.
1 rule found Severity: Medium
The TippingPoint SMS must enforce access restrictions associated with changes to device configuration.
1 rule found Severity: Medium
The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.
1 rule found Severity: High
The web server application, libraries, and configuration files must only be accessible to privileged users.
1 rule found Severity: Medium
Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
2 rules found Severity: High
The Apache web server application, libraries, and configuration files must only be accessible to privileged users.
1 rule found Severity: Medium
1 rule found Severity: High
The application server must enforce access restrictions associated with changes to application server configuration.
1 rule found Severity: Medium
AlmaLinux OS 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
1 rule found Severity: Medium
The container platform must enforce access restrictions for container platform configuration changes.
1 rule found Severity: Medium
The DBMS must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
1 rule found Severity: Medium
1 rule found Severity: Medium
MariaDB must enforce access restrictions associated with changes to the configuration of MariaDB or database(s).
1 rule found Severity: Medium
The Mainframe Product must enforce access restrictions associated with changes to application configuration.
1 rule found Severity: Medium
SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).
1 rule found Severity: Medium
SQL Server must enforce access restrictions associated with changes to the configuration of the instance.
1 rule found Severity: Medium
Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.
1 rule found Severity: Medium
Users requiring access to Prisma Cloud Compute's Credential Store must be assigned and accessed by the appropriate role holders.
1 rule found Severity: Medium
The UEM server must enforce access restrictions associated with changes to the server configuration.
1 rule found Severity: Medium
The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High