Capacity
CCI-001942
The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The ALG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The application must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The CA API Gateway providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
CounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
IBM Aspera Console must be configured with a preestablished trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.
1
Rule
Severity: Medium
IBM Aspera Faspex must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1
Rule
Severity: Medium
IBM Aspera Shares must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
1
Rule
Severity: Medium
The DataPower Gateway providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The Sentry providing mobile device authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.
2
Rule
Severity: Medium
The built-in DNS client must be disabled.
1
Rule
Severity: Medium
Nutanix AOS must implement replay-resistant authentication mechanisms for network access to privileged accounts.
1
Rule
Severity: Medium
Symantec ProxySG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
1
Rule
Severity: Medium
The UEM server must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The IPsec VPN Gateway must use anti-replay mechanisms for security associations.
1
Rule
Severity: High
The macOS system must disable the SSHD service.
1
Rule
Severity: Medium
The macOS system must enable SSH server for remote access sessions.
1
Rule
Severity: High
The Ubuntu operating system must enforce SSHv2 for network access to all accounts.
1
Rule
Severity: Medium
The container platform must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Medium
The operating system must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
2
Rule
Severity: High
AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
2
Rule
Severity: Medium
Kerberos user logon restrictions must be enforced.
2
Rule
Severity: Medium
The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
2
Rule
Severity: Medium
The Kerberos user ticket lifetime must be limited to 10 hours or less.
2
Rule
Severity: Medium
The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
2
Rule
Severity: Medium
The computer clock synchronization tolerance must be limited to 5 minutes or less.
3
Rule
Severity: Medium
Windows Server 2019 Kerberos user logon restrictions must be enforced.
3
Rule
Severity: Medium
Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
3
Rule
Severity: Medium
Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.
3
Rule
Severity: Medium
Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
3
Rule
Severity: Medium
Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.
3
Rule
Severity: Medium
Windows Server 2022 Kerberos user logon restrictions must be enforced.
3
Rule
Severity: Medium
Windows Server 2022 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
3
Rule
Severity: Medium
Windows Server 2022 Kerberos user ticket lifetime must be limited to 10 hours or less.
3
Rule
Severity: Medium
Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
3
Rule
Severity: Medium
Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.
2
Rule
Severity: High
OpenShift must use FIPS validated LDAP or OpenIDConnect.
1
Rule
Severity: Medium
RHEL 9 must use the CAC smart card driver.
2
Rule
Severity: Medium
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
1
Rule
Severity: Medium
The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
1
Rule
Severity: Low
The ESXi host must use Active Directory for local user authentication.
3
Rule
Severity: Low
The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.
1
Rule
Severity: Medium
The Photon operating system must use an OpenSSH server version that does not support protocol 1.
1
Rule
Severity: Medium
The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must be configured to implement replay-resistant authentication mechanisms for network access.
1
Rule
Severity: Medium
The Enterprise Voice, Video, and Messaging Session Manager must be configured to implement attack-resistant mechanisms for Voice Video Endpoint registration.
1
Rule
Severity: Medium
The Sentry providing mobile device authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
1
Rule
Severity: Medium
MKE must be configured to integrate with an Enterprise Identity Provider.
1
Rule
Severity: Medium
RHEL 9 must use the common access card (CAC) smart card driver.
1
Rule
Severity: High
SLEM 5 must have SSH installed to protect the confidentiality and integrity of transmitted information.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules