Skip to content
ATO Pathways
  Log In

I - Mission Critical Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000023-NDM-000205

    <GroupDescription></GroupDescription>
    Group
    Show

  • Access to the MQ Appliance network element must use two or more authentication servers for the purpose of granting administrative access.

    &lt;VulnDiscussion&gt;All accounts used for access to the MQ Appliance network device are privileged or system-level accounts. Therefore, if accoun...
    Rule Medium Severity
    Show

  • SRG-APP-000025-NDM-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device access must automatically disable accounts after a 35-day period of account inactivity.

    &lt;VulnDiscussion&gt;Since the accounts in the MQ Appliance network device are privileged or system-level accounts, account management is vital to...
    Rule Medium Severity
    Show

  • SRG-APP-000065-NDM-000214

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.

    &lt;VulnDiscussion&gt;By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-APP-000068-NDM-000215

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

    &lt;VulnDiscussion&gt;Display of the DoD-approved use notification before granting access to the MQ Appliance network device ensures privacy and se...
    Rule Medium Severity
    Show

  • SRG-APP-000079-NDM-000219

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must notify the administrator of changes to access and/or privilege parameters of the administrator account that occurred since the last logon.

    &lt;VulnDiscussion&gt;Providing administrators with information regarding security-related changes to their account allows them to determine if any...
    Rule Medium Severity
    Show

  • SRG-APP-000080-NDM-000220

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

    &lt;VulnDiscussion&gt;This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integ...
    Rule Medium Severity
    Show

  • SRG-APP-000108-NDM-000232

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must alert the Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) in the event of an audit processing failure.

    &lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required....
    Rule Medium Severity
    Show

  • SRG-APP-000125-NDM-000241

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

    &lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Regularly backing up audit records to ...
    Rule Medium Severity
    Show

  • SRG-APP-000148-NDM-000246

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access to the MQ Appliance, organizational administrators must be unique...
    Rule Medium Severity
    Show

  • SRG-APP-000148-NDM-000346

    <GroupDescription></GroupDescription>
    Group
    Show

  • In the event the authentication server is unavailable, the MQ Appliance must provide one local account created for emergency administration use.

    &lt;VulnDiscussion&gt;Authentication for administrative (privileged level) access to the MQ Appliance is required at all times. An account can be c...
    Rule Medium Severity
    Show

  • SRG-APP-000149-NDM-000247

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must use multifactor authentication for network access to privileged accounts.

    &lt;VulnDiscussion&gt;Multifactor authentication requires using two or more factors to achieve authenticated access to the MQ Appliance. Factors in...
    Rule Medium Severity
    Show

  • SRG-APP-000156-NDM-000250

    <GroupDescription></GroupDescription>
    Group
    Show

  • When connecting to the MQ Appliance network device using the WebGUI, it must implement replay-resistant authentication mechanisms for network access to privileged accounts.

    &lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the MQ Appliance. Authentication sessions between the authe...
    Rule Medium Severity
    Show

  • SRG-APP-000164-NDM-000252

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce a minimum 15-character password length.

    &lt;VulnDiscussion&gt;Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute...
    Rule Medium Severity
    Show

  • SRG-APP-000165-NDM-000253

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must prohibit password reuse for a minimum of five generations.

    &lt;VulnDiscussion&gt;Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute...
    Rule Medium Severity
    Show

  • SRG-APP-000166-NDM-000254

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce password complexity by requiring that at least one upper-case character be used.

    &lt;VulnDiscussion&gt;Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity,...
    Rule Medium Severity
    Show

  • SRG-APP-000167-NDM-000255

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce password complexity by requiring that at least one lower-case character be used.

    &lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, ...
    Rule Medium Severity
    Show

  • SRG-APP-000168-NDM-000256

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce password complexity by requiring that at least one numeric character be used.

    &lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, ...
    Rule Medium Severity
    Show

  • SRG-APP-000169-NDM-000257

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must enforce password complexity by requiring that at least one special character be used.

    &lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, ...
    Rule Medium Severity
    Show

  • SRG-APP-000174-NDM-000261

    <GroupDescription></GroupDescription>
    Group
    Show

  • Authorization for access to the MQ Appliance network device must enforce a 60-day maximum password lifetime restriction.

    &lt;VulnDiscussion&gt;Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals...
    Rule Medium Severity
    Show

  • SRG-APP-000175-NDM-000262

    <GroupDescription></GroupDescription>
    Group
    Show

  • WebGUI access to the MQ Appliance network device, when using PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

    &lt;VulnDiscussion&gt;Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate n...
    Rule Medium Severity
    Show

  • SRG-APP-000177-NDM-000263

    <GroupDescription></GroupDescription>
    Group
    Show

  • WebGUI access to the MQ Appliance network device must map the authenticated identity to the user account for PKI-based authentication.

    &lt;VulnDiscussion&gt;Authorization for access to any MQ Appliance network device requires an approved and assigned individual account identifier. ...
    Rule Medium Severity
    Show

  • SRG-APP-000179-NDM-000265

    <GroupDescription></GroupDescription>
    Group
    Show

  • The MQ Appliance network device must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.

    &lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be r...
    Rule Medium Severity
    Show

  • SRG-APP-000186-NDM-000266

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebGUI of the MQ Appliance network device must terminate all sessions and network connections when nonlocal device maintenance is completed.

    &lt;VulnDiscussion&gt; If an MQ Appliance device management session or connection remains open after management is completed, it may be hijacked by...
    Rule Medium Severity
    Show

  • SRG-APP-000190-NDM-000267

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebGUI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

    &lt;VulnDiscussion&gt;Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take c...
    Rule Medium Severity
    Show

  • SRG-APP-000190-NDM-000267

    <GroupDescription></GroupDescription>
    Group
    Show

  • The SSH CLI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

    &lt;VulnDiscussion&gt;Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take c...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules