Skip to content
ATO Pathways
  Log In

Nutanix AOS 5.20.x Application Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000340-AS-000185

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000118-AS-000078

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must utilize encryption when using LDAP for authentication.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmissi...
    Rule High Severity
    Show

  • SRG-APP-000175-AS-000124

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000315-AS-000094

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must disable Remote Support Sessions.

    &lt;VulnDiscussion&gt;Application servers provide remote access capability and must be able to enforce remote access policy requirements or work in...
    Rule Medium Severity
    Show

  • SRG-APP-000014-AS-000009

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must implement cryptography mechanisms to protect the confidentiality and integrity of the remote access session.

    &lt;VulnDiscussion&gt;Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious use...
    Rule High Severity
    Show

  • SRG-APP-000033-AS-000024

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS role mapping must be configured to the lowest privilege level needed for user access.

    &lt;VulnDiscussion&gt;Strong access controls are critical to securing the application server. Access control policies (e.g., identity-based policie...
    Rule Medium Severity
    Show

  • Nutanix AOS must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

    &lt;VulnDiscussion&gt;Preventing nonprivileged users from executing privileged functions mitigates the risk that unauthorized individuals or proces...
    Rule Medium Severity
    Show

  • SRG-APP-000068-AS-000035

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must display the standard Mandatory DoD Notice and Consent Banner before granting access to the system.

    &lt;VulnDiscussion&gt;Application servers are required to display the Standard Mandatory DoD Notice and Consent Banner before granting access to th...
    Rule Low Severity
    Show

  • SRG-APP-000080-AS-000045

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must offload log records onto a syslog server.

    &lt;VulnDiscussion&gt;Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to...
    Rule Medium Severity
    Show

  • SRG-APP-000359-AS-000065

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must provide an immediate warning to the SA and ISSO, at a minimum, when allocated log record storage volume reaches 75 percent of maximum log record storage capacity.

    &lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process logs as required. Log p...
    Rule Medium Severity
    Show

  • SRG-APP-000108-AS-000067

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must be configured to send Cluster Check alerts to the SA and ISSO.

    &lt;VulnDiscussion&gt;Logs are essential to monitor the health of the system, investigate changes that occurred to the system, or investigate a sec...
    Rule Medium Severity
    Show

  • SRG-APP-000371-AS-000077

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must be configured to synchronize internal information system clocks using redundant authoritative time sources.

    &lt;VulnDiscussion&gt;Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysi...
    Rule Low Severity
    Show

  • Nutanix AOS must protect log information from any type of unauthorized access.

    &lt;VulnDiscussion&gt;If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially mali...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must enforce access restrictions associated with changes to application server configuration.

    &lt;VulnDiscussion&gt;When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software, and/...
    Rule Medium Severity
    Show

  • SRG-APP-000148-AS-000101

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must use an enterprise user management system to uniquely identify and authenticate users.

    &lt;VulnDiscussion&gt;To ensure accountability and prevent unauthorized access, application server users must be uniquely identified and authentica...
    Rule Medium Severity
    Show

  • SRG-APP-000149-AS-000102

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must use multifactor authentication for account access.

    &lt;VulnDiscussion&gt;Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the app...
    Rule Medium Severity
    Show

  • SRG-APP-000391-AS-000239

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must accept Personal Identity Verification (PIV) credentials to access the management interface.

    &lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. PIV credentials are only...
    Rule Medium Severity
    Show

  • SRG-APP-000172-AS-000121

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must perform RFC 5280-compliant certification path validation.

    &lt;VulnDiscussion&gt;A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA)...
    Rule High Severity
    Show

  • SRG-APP-000514-AS-000137

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.

    &lt;VulnDiscussion&gt;Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certifica...
    Rule High Severity
    Show

  • SRG-APP-000231-AS-000133

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must protect the confidentiality and integrity of all information at rest.

    &lt;VulnDiscussion&gt;When data is written to digital media such as hard drives, mobile computers, external/removable hard drives, personal digital...
    Rule High Severity
    Show

  • SRG-APP-000267-AS-000170

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must restrict error messages only to authorized users.

    &lt;VulnDiscussion&gt;If the application provides too much information in error logs and administrative messages to the screen, this could lead to ...
    Rule Medium Severity
    Show

  • SRG-APP-000211-AS-000146

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must separate hosted application functionality from application server management functionality.

    &lt;VulnDiscussion&gt;The application server consists of the management interface and hosted applications. By separating the management interface f...
    Rule Medium Severity
    Show

  • SRG-APP-000211-AS-000146

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must configure network traffic segmentation when using Disaster Recovery Services.

    &lt;VulnDiscussion&gt;The application server consists of the management interface and hosted applications, as well as cluster management functions....
    Rule Medium Severity
    Show

  • SRG-APP-000456-AS-000266

    <GroupDescription></GroupDescription>
    Group
    Show

  • Nutanix AOS must be running an operating system release that is currently supported by the vendor.

    &lt;VulnDiscussion&gt;Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products t...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules