Skip to content
Log In

General Purpose Operating System Security Requirements Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • The operating system must audit all account enabling actions.

    Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to enable a new ...
    Rule Medium Severity
    Show

  • SRG-OS-000304

    Group
    Show

  • SRG-OS-000312

    Group
    Show

  • SRG-OS-000312

    Group
    Show

  • SRG-OS-000312

    Group
    Show

  • The operating system must allow operating system admins to change security attributes on users, the operating system, or the operating systems components.

    Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which...
    Rule Medium Severity
    Show

  • SRG-OS-000324

    Group
    Show

  • SRG-OS-000326

    Group
    Show

  • The operating system must prevent all software from executing at higher privilege levels than users executing the software.

    In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level...
    Rule Medium Severity
    Show

  • SRG-OS-000327

    Group
    Show

  • SRG-OS-000329

    Group
    Show

  • The operating system must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur.

    By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the a...
    Rule Medium Severity
    Show

  • SRG-OS-000337

    Group
    Show

  • SRG-OS-000341

    Group
    Show

  • SRG-OS-000342

    Group
    Show

  • The operating system must offload audit records onto a different system or media from the system being audited.

    Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
    Rule Low Severity
    Show

  • SRG-OS-000343

    Group
    Show

  • The operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

    If security personnel are not notified immediately when storage volume reaches 75% utilization, they are unable to plan for audit record storage capacity expansion.
    Rule Low Severity
    Show

  • SRG-OS-000344

    Group
    Show

  • SRG-OS-000348

    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules