I - Mission Critical Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000363-GPOS-00150
<GroupDescription></GroupDescription>Group -
Advanced Intrusion Detection Environment (AIDE) must verify the baseline SUSE operating system configuration at least weekly.
<VulnDiscussion>Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized ...Rule Medium Severity -
SRG-OS-000366-GPOS-00153
<GroupDescription></GroupDescription>Group -
The SUSE operating system tool zypper must have gpgcheck enabled.
<VulnDiscussion>Changes to any software components can have significant effects on the overall security of the SUSE operating system. This re...Rule High Severity -
SRG-OS-000373-GPOS-00156
<GroupDescription></GroupDescription>Group -
The SUSE operating system must reauthenticate users when changing authenticators, roles, or escalating privileges.
<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When the SU...Rule High Severity -
SRG-OS-000375-GPOS-00160
<GroupDescription></GroupDescription>Group -
The SUSE operating system must have the packages required for multifactor authentication to be installed.
<VulnDiscussion>Using an authentication device, such as a Common Access Card (CAC) or token separate from the information system, ensures tha...Rule Medium Severity -
SRG-OS-000375-GPOS-00160
<GroupDescription></GroupDescription>Group -
The SUSE operating system must implement certificate status checking for multifactor authentication.
<VulnDiscussion>Using an authentication device, such as a Common Access Card (CAC) or token separate from the information system, ensures cre...Rule Medium Severity -
SRG-OS-000378-GPOS-00163
<GroupDescription></GroupDescription>Group -
The SUSE operating system must disable the USB mass storage kernel module.
<VulnDiscussion>Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Per...Rule Medium Severity -
SRG-OS-000383-GPOS-00166
<GroupDescription></GroupDescription>Group -
If Network Security Services (NSS) is being used by the SUSE operating system it must prohibit the use of cached authentications after one day.
<VulnDiscussion>If cached authentication information is out of date, the validity of the authentication information may be questionable.</...Rule Medium Severity -
SRG-OS-000383-GPOS-00166
<GroupDescription></GroupDescription>Group -
The SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.
<VulnDiscussion>If cached authentication information is out of date, the validity of the authentication information may be questionable.</...Rule Medium Severity -
SRG-OS-000396-GPOS-00176
<GroupDescription></GroupDescription>Group -
FIPS 140-2 mode must be enabled on the SUSE operating system.
<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The SUSE operating...Rule High Severity -
SRG-OS-000423-GPOS-00187
<GroupDescription></GroupDescription>Group -
All networked SUSE operating systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
<VulnDiscussion>Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected commu...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.