Capacity
CCI-003992
Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Apache web server.
2
Rule
Severity: High
The macOS system must apply gatekeeper settings to block applications from unidentified developers.
1
Rule
Severity: High
The macOS system must enable Gatekeeper.
1
Rule
Severity: High
The macOS system must enable gatekeeper.
1
Rule
Severity: Medium
The application server must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate recognized and approved by the organization.
1
Rule
Severity: Medium
The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Low
Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
The Ubuntu operating system's Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
The Central Log Server must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
The container platform must be built from verified packages.
1
Rule
Severity: Medium
The container platform must verify container images.
1
Rule
Severity: Medium
The DBMS must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate recognized and approved by the organization.
1
Rule
Severity: Medium
The DNS server implementation must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Low
Forescout must prevent the installation of patches, service packs, plug-ins, or modules without verification the update has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: High
The operating system must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
A private web server must subscribe to certificates, issued from any DOD-authorized Certificate Authority (CA), as an access control mechanism for web users.
1
Rule
Severity: Medium
The Mainframe Product must prevent the installation of patches, service packs, or application components without verification that the software component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
MKE must only run signed images.
2
Rule
Severity: Medium
Exchange local machine policy must require signed scripts.
2
Rule
Severity: Medium
Trust Bar Notifications for unsigned application add-ins in Access must be disabled and blocked.
2
Rule
Severity: Medium
Trust Bar notifications must be configured to display information in the Message Bar about the content that has been automatically blocked.
2
Rule
Severity: Medium
Trust Bar notification must be enabled for unsigned application add-ins in Excel and blocked.
2
Rule
Severity: Medium
Project must automatically disable unsigned add-ins without informing users.
2
Rule
Severity: Medium
Unsigned add-ins in PowerPoint must be blocked with no Trust Bar Notification to the user.
2
Rule
Severity: Medium
Publisher must automatically disable unsigned add-ins without informing users.
2
Rule
Severity: Medium
Publisher must disable all unsigned VBA macros.
2
Rule
Severity: Medium
Visio must automatically disable unsigned add-ins without informing users.
2
Rule
Severity: Medium
Word must automatically disable unsigned add-ins without informing users.
1
Rule
Severity: Medium
The network device must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: High
The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.
1
Rule
Severity: High
The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
1
Rule
Severity: High
The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
1
Rule
Severity: High
YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: High
OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
1
Rule
Severity: Medium
OL 8 must prevent the loading of a new kernel for later execution.
1
Rule
Severity: Medium
The Oracle Linux operating system must ensure cryptographic verification of vendor software packages.
1
Rule
Severity: Medium
OL 8 must ensure cryptographic verification of vendor software packages.
1
Rule
Severity: High
All Automation Controller NGINX front-end web server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server.
1
Rule
Severity: Medium
Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Automation Controller NGINX front-end web server.
1
Rule
Severity: Medium
OpenShift must verify container images.
1
Rule
Severity: High
RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
1
Rule
Severity: High
RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.
1
Rule
Severity: Medium
RHEL 8 must prevent the loading of a new kernel for later execution.
1
Rule
Severity: Medium
RHEL 9 must prevent the loading of a new kernel for later execution.
1
Rule
Severity: Medium
RHEL 9 must ensure cryptographic verification of vendor software packages.
1
Rule
Severity: High
RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
1
Rule
Severity: High
RHEL 9 must check the GPG signature of locally installed software packages before installation.
1
Rule
Severity: High
RHEL 9 must have GPG signature verification enabled for all software repositories.
1
Rule
Severity: Medium
RHEL 9 subscription-manager package must be installed.
1
Rule
Severity: Medium
RHEL 8 must ensure cryptographic verification of vendor software packages.
1
Rule
Severity: Medium
The SUSE operating system tool zypper must have gpgcheck enabled.
1
Rule
Severity: High
The SUSE operating system tool zypper must have gpgcheck enabled.
2
Rule
Severity: Medium
The system must verify that package updates are digitally signed.
2
Rule
Severity: Medium
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
2
Rule
Severity: Medium
The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.
1
Rule
Severity: Medium
The Tanium Server must be configured to allow only signed content to be imported.
1
Rule
Severity: High
TOSS must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: Medium
The VMM must prevent the installation of guest VMs, patches, service packs, device drivers, or VMM components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
1
Rule
Severity: High
The ESXi Image Profile and vSphere Installation Bundle (VIB) acceptance level must be verified.
1
Rule
Severity: Medium
All web server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server.
1
Rule
Severity: Medium
Expansion modules must be fully reviewed, tested, and signed before they can exist on a production web server.
1
Rule
Severity: High
The Photon operating system TDNF package management tool must cryptographically verify the authenticity of all software packages during installation.
1
Rule
Severity: High
The Photon operating system TDNF package management tool must cryptographically verify the authenticity of all software packages during installation for all repos.
1
Rule
Severity: Medium
The UEM server must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
7
Rule
Severity: High
Ensure gpgcheck Enabled In Main dnf Configuration
6
Rule
Severity: High
Ensure gpgcheck Enabled for All dnf Package Repositories
13
Rule
Severity: High
Ensure gpgcheck Enabled for Local Packages
10
Rule
Severity: High
Ensure gpgcheck Enabled In Main yum Configuration
10
Rule
Severity: High
Ensure Red Hat GPG Key Installed
5
Rule
Severity: Unknown
Disable unauthenticated repositories in APT configuration
6
Rule
Severity: Medium
Install subscription-manager Package
10
Rule
Severity: Medium
Disable Kernel Image Loading
7
Rule
Severity: High
Ensure gpgcheck Enabled for All yum Package Repositories
3
Rule
Severity: High
Ensure gpgcheck Enabled In Main zypper Configuration
2
Rule
Severity: High
Ensure gpgcheck Enabled for All zypper Package Repositories
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules