CCI-003628

Disable accounts when the accounts are no longer associated to a user.

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

2 rules found Severity: High

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

22 rules found Severity: Medium

10 rules found Severity: Medium

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

CCI-003628

The Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access.

The DNS server implementation must disable accounts when the accounts are no longer associated to a user.

The ICS must be configured to prevent nonprivileged users from executing privileged functions.

The Juniper EX switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.

The network device must be configured to disable accounts when the accounts are no longer associated to a user.

The Riverbed NetProfiler must be configured to use an authentication server to authenticate users prior to granting administrative access.

The TippingPoint SMS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.

TOSS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The web server must disable accounts when the accounts are no longer associated to a user.

Set Account Expiration Following Inactivity

Set existing passwords a period of inactivity before they been locked

AAA Services must be configured to disable accounts when the accounts are no longer associated to a user.

The macOS system must disable accounts after 35 days of inactivity.

The application server must disable accounts when the accounts are no longer associated to a user.

Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The Central Log Server must disable accounts when the accounts are no longer associated to a user.

The container platform must disable accounts when the accounts are no longer associated to a user.

The DBMS must disable accounts when the accounts are no longer associated to a user.

Forescout must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.

The operating system must disable accounts when the accounts are no longer associated to a user.

The IBM z/OS system administrator (SA) must develop a procedure to automatically remove or disable temporary user accounts after 72 hours.

The IBM z/OS system administrator (SA) must develop a process to disable emergency accounts after the crisis is resolved or 72 hours.

IBM z/OS system administrator must develop a procedure to remove or disable temporary user accounts after 72 hours.

IBM z/OS system administrator (SA) must develop a procedure to remove or disable temporary user accounts after 72 hours.

IBM z/OS system administrator (SA) must develop a procedure to remove or disable emergency accounts after the crisis is resolved or 72 hours.

The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.

The Mainframe Product must disable accounts when the accounts are no longer associated to a user.

The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.

The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.

RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The SUSE operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.

User accounts must be locked after 35 days of inactivity.

The VMM must disable accounts when the accounts are no longer associated to a user.