Capacity
CCI-001967
Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The A10 Networks ADC must authenticate Network Time Protocol sources.
1
Rule
Severity: Medium
The Arista Multilayer Switch must authenticate all endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The Arista Multilayer Switch must re-authenticate all endpoint devices every 60 minutes or less.
2
Rule
Severity: Medium
The Arista network device must be configured to synchronize internal system clocks using redundant authenticated time sources.
2
Rule
Severity: Medium
The Arista network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.
2
Rule
Severity: High
The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.
1
Rule
Severity: Low
The CA API Gateway must authenticate NTP endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The CA API Gateway must authenticate SNMP endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The CA API Gateway must authenticate RADIUS endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The CA API Gateway must authenticate LDAPS endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The CA API Gateway must obtain LDAPS server certificates securely to use bidirectional authentication that is cryptographically based.
1
Rule
Severity: High
FIPS mode must be enabled on all Docker Engine - Enterprise nodes.
3
Rule
Severity: Medium
The DNS server implementation must authenticate another DNS server before establishing a remote and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The FortiGate device must authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1
Rule
Severity: Medium
The FortiGate device must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
CounterACT must authenticate any endpoint used for network management before establishing a local, remote, and/or network connection using cryptographically based bidirectional authentication.
1
Rule
Severity: High
CounterACT must authenticate SNMPv3 endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
2
Rule
Severity: High
Forescout must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
Before establishing a connection with a Network Time Protocol (NTP) server, Forescout must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server.
2
Rule
Severity: Medium
Forescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.
1
Rule
Severity: Medium
The HYCU server must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
The Infoblox DNS server must authenticate another DNS server before establishing a remote and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: High
The DataPower Gateway must use SNMPv3.
1
Rule
Severity: High
The MQ Appliance messaging server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The WebSphere Application Server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The MobileIron Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 EMM Suite must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
2
Rule
Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 EMM Suite must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are Government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
2
Rule
Severity: Medium
The Juniper router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
The Juniper router must be configured to authenticate NTP sources using authentication that is cryptographically based.
2
Rule
Severity: Medium
The Juniper SRX Services Gateway must authenticate NTP servers before establishing a network connection using bidirectional authentication that is cryptographically based.
2
Rule
Severity: Medium
RPC encryption between Outlook and Exchange server must be enforced.
1
Rule
Severity: Medium
Outlook must be configured to force authentication when connecting to an Exchange server.
1
Rule
Severity: Medium
Authentication with Exchange Server must be required.
1
Rule
Severity: Medium
RPC encryption between Outlook and Exchange server must be enforced.
1
Rule
Severity: Medium
Outlook must be configured to force authentication when connecting to an Exchange server.
1
Rule
Severity: Low
The Microsoft SCOM SNMP Monitoring in SCOM must use SNMP V3.
2
Rule
Severity: Medium
ONTAP must be configured to authenticate SNMP messages using FIPS-validated Keyed-HMAC.
2
Rule
Severity: Medium
ONTAP must authenticate NTP sources using authentication that is cryptographically based.
6
Rule
Severity: Medium
The network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
The network device must authenticate Network Time Protocol sources using authentication that is cryptographically based.
2
Rule
Severity: Medium
The Riverbed NetProfiler must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
The Riverbed NetProfiler must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
Riverbed Optimization System (RiOS) must authenticate network management endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
Riverbed Optimization System (RiOS) must authenticate SNMP server before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
Riverbed Optimization System (RiOS) must authenticate NTP server before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The SEL-2740S must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
The Tanium Server must protect the confidentiality and integrity of transmitted information with cryptographic signing capabilities enabled to ensure the authenticity of communications sessions when making requests from Tanium Clients.
1
Rule
Severity: Medium
Symantec ProxySG must configure SNMPv3 so that cryptographically-based bidirectional authentication is used.
2
Rule
Severity: Medium
The Tanium application must authenticate endpoint devices (servers) before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1
Rule
Severity: Medium
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
2
Rule
Severity: High
The TippingPoint SMS must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: High
The TippingPoint SMS must authenticate Network Time Protocol sources using authentication that is cryptographically based.
2
Rule
Severity: High
Before establishing a connection to any endpoint device being managed, the UEM server must establish a trusted path between the server and endpoint that provides assured identification of the end point using a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
2
Rule
Severity: Medium
The UEM server must authenticate endpoint devices (servers) before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
2
Rule
Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the UEM server must have a minimum security strength of 112 bits or higher.
2
Rule
Severity: Medium
The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.
1
Rule
Severity: High
The macOS system must disable the SSHD service.
1
Rule
Severity: Medium
The macOS system must restrict the ability to utilize external writeable media devices.
4
Rule
Severity: Low
The macOS system must be configured with Bluetooth turned off unless approved by the organization.
2
Rule
Severity: Medium
The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm.
2
Rule
Severity: Medium
The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based.
6
Rule
Severity: Medium
The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
4
Rule
Severity: Medium
The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
6
Rule
Severity: Medium
The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
6
Rule
Severity: Medium
The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
2
Rule
Severity: Medium
The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based.
2
Rule
Severity: Medium
Before establishing a connection with a Network Time Protocol (NTP) server, the Cisco ISE must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server. This is required for compliance with C2C Step 1.
2
Rule
Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the Cisco ISE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.
2
Rule
Severity: Medium
The Cisco ISE must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1
Rule
Severity: Medium
The Cisco ISE must authenticate Network Time Protocol sources using authentication that is cryptographically based.
2
Rule
Severity: Medium
The operating system must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
2
Rule
Severity: Medium
The ICS that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.
2
Rule
Severity: Medium
If SNMP is used, the ICS must be configured to use SNMPv3 with FIPS-140-2/3 validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Medium
The ICS must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
2
Rule
Severity: High
The Juniper EX switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
2
Rule
Severity: Low
The Juniper EX switch must use an an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server.
3
Rule
Severity: Medium
The Exchange client authentication with Exchange servers must be enabled to use Kerberos Password Authentication.
3
Rule
Severity: Medium
Outlook must use remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers.
4
Rule
Severity: Medium
The network device must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
4
Rule
Severity: Medium
Unauthenticated RPC clients must be restricted from connecting to the RPC server.
2
Rule
Severity: Medium
Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server.
2
Rule
Severity: Medium
The computer account password must not be prevented from being reset.
2
Rule
Severity: Medium
Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
2
Rule
Severity: Medium
Windows Server 2019 computer account password must not be prevented from being reset.
2
Rule
Severity: Medium
Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
2
Rule
Severity: Medium
Windows Server 2022 computer account password must not be prevented from being reset.
3
Rule
Severity: Medium
WLAN components must be FIPS 140-2 or FIPS 140-3 certified and configured to operate in FIPS mode.
2
Rule
Severity: Medium
The Palo Alto Networks security platform must authenticate Network Time Protocol sources.
2
Rule
Severity: Medium
The VMM must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
3
Rule
Severity: Medium
The ESXi host must enable bidirectional Challenge-Handshake Authentication Protocol (CHAP) authentication for Internet Small Computer Systems Interface (iSCSI) traffic.
4
Rule
Severity: High
The vCenter Server must enable FIPS-validated cryptography.
4
Rule
Severity: Medium
The vCenter server must enforce SNMPv3 security features where SNMP is required.
4
Rule
Severity: Medium
The vCenter server must disable SNMPv1/2 receivers.
1
Rule
Severity: Medium
The Cisco ISE must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
Before establishing a network connection with a Network Time Protocol (NTP) server, Dragos Platform must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server.
1
Rule
Severity: Medium
The F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1
Rule
Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 SPHERE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
1
Rule
Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1
Rule
Severity: Medium
The Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules