Capacity
CCI-002132
The information system notifies organization-defined personnel or roles for account enabling actions.
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/group
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/gshadow
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/security/opasswd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/passwd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/shadow
8
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers
7
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
1
Rule
Severity: Medium
The A10 Networks ADC must notify System Administrators (SAs) and Information System Security Officers (ISSMs) when accounts are created, or enabled when previously disabled.
1
Rule
Severity: Medium
AAA Services must be configured to notify system administrators and ISSO of account enabling actions.
1
Rule
Severity: Medium
Compliance Guardian must provide automated mechanisms for supporting account management functions.
1
Rule
Severity: Medium
The Akamai Luna Portal must notify the SAs and ISSO when accounts are created, or enabled when previously disabled.
1
Rule
Severity: Low
The application must notify System Administrators and Information System Security Officers of account enabling actions.
1
Rule
Severity: Medium
The CA API Gateway must notify System Administrators (SAs) and Information System Security Officers (ISSMs) when accounts are created, or enabled when previously disabled.
1
Rule
Severity: Medium
The HP FlexFabric Switch must generate an immediate alert for account enabling actions.
1
Rule
Severity: Medium
The DataPower Gateway must generate an immediate alert for account enabling actions.
1
Rule
Severity: Medium
The MQ Appliance network device must generate account activity alerts that are forwarded to the administrators and Information System Security Officer (ISSO). Activity includes, creation, removal, modification and re-enablement after being previously disabled.
2
Rule
Severity: High
The Juniper SRX Services Gateway must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management.
1
Rule
Severity: Medium
The Mainframe Product must notify system programmers and security administrators of account enabling actions.
1
Rule
Severity: High
Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.
1
Rule
Severity: Medium
Tanium must notify the SA and ISSO of account enabling actions.
2
Rule
Severity: Medium
Tanium must notify the system administrator and information system security officer (ISSO) of account enabling actions.
1
Rule
Severity: Medium
The Tanium application must notify SA and ISSO of account enabling actions.
1
Rule
Severity: Medium
Tanium must notify system administrator and ISSO of account enabling actions.
1
Rule
Severity: Medium
Tanium must audit and notify system administrators and ISSOs when accounts are enabled.
1
Rule
Severity: Medium
The UEM server must notify system administrator and Information System Security Officer (ISSO) of account enabling actions.
1
Rule
Severity: Medium
The container platform must notify system administrator and ISSO of account enabling actions.
1
Rule
Severity: Medium
The operating system must notify system administrators and ISSOs of account enabling actions.
2
Rule
Severity: Medium
AIX must provide audit record generation functionality for DoD-defined auditable events.
1
Rule
Severity: Medium
IBM z/OS system administrator must develop a procedure to notify system administrators and ISSOs of account enabling actions.
1
Rule
Severity: Medium
The IBM z/OS System Administrator (SA) must develop a process to notify Information System Security Officers (ISSOs) of account enabling actions.
1
Rule
Severity: Medium
IBM z/OS system administrator must develop a procedure to notify System Administrators and ISSOs of account enabling actions.
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creation events that affect "/etc/group".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
2
Rule
Severity: Medium
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
2
Rule
Severity: Medium
OpenShift must generate audit rules to capture account related actions.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
4
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
2
Rule
Severity: Medium
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
2
Rule
Severity: Medium
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
1
Rule
Severity: Medium
The VMM must notify the system administrator and ISSO of account enabling actions.
4
Rule
Severity: Medium
The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.
1
Rule
Severity: Medium
The BIG-IP appliance must be configured to generate an immediate alert for account-enabling actions.
1
Rule
Severity: Low
The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.
1
Rule
Severity: Medium
MKE must be configured to integrate with an Enterprise Identity Provider.
1
Rule
Severity: Medium
SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
1
Rule
Severity: Medium
Tanium must audit and notify system administrators (SAs) and information system security officers (ISSOs) when accounts are enabled.
1
Rule
Severity: Medium
Tanium must notify the system administrator (SA) and information system security officer (ISSO) of account enabling actions.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules