Skip to content
ATO Pathways
  Log In

III - Administrative Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000291

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are created.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establ...
    Rule Medium Severity
    Show

  • SRG-APP-000292

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified.

    &lt;VulnDiscussion&gt;When application accounts are modified, user accessibility is affected. Accounts are utilized for identifying individual user...
    Rule Medium Severity
    Show

  • SRG-APP-000293

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must notify system administrators (SAs) and the information system security officer (ISSO) for account disabling actions.

    &lt;VulnDiscussion&gt;When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual user...
    Rule Medium Severity
    Show

  • SRG-APP-000294

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must notify system administrators (SAs) and the information system security officer (ISSO) for account removal actions.

    &lt;VulnDiscussion&gt;When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying users or for ide...
    Rule Medium Severity
    Show

  • SRG-APP-000295

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must automatically terminate a user session after an organization-defined period of user inactivity.

    &lt;VulnDiscussion&gt;Automatic session termination addresses the termination of user-initiated logical sessions in contrast to the termination of ...
    Rule Medium Severity
    Show

  • SRG-APP-000296

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must provide logout capability for user-initiated communication sessions.

    &lt;VulnDiscussion&gt;If a user cannot explicitly end an application session, the session may remain open and be exploited by an attacker; this is ...
    Rule Medium Severity
    Show

  • SRG-APP-000297

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.

    &lt;VulnDiscussion&gt;If a user cannot explicitly end an application session, the session may remain open and be exploited by an attacker; this is ...
    Rule Medium Severity
    Show

  • SRG-APP-000319

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must automatically audit account-enabling actions.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establ...
    Rule Medium Severity
    Show

  • SRG-APP-000320

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must notify system administrator (SA) and information system security officer (ISSO) of account enabling actions.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establ...
    Rule Medium Severity
    Show

  • SRG-APP-000329

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must be configured to have at least one user in defined administrator roles.

    &lt;VulnDiscussion&gt;Having several administrative roles for the UEM server supports separation of duties. This allows administrator-level privile...
    Rule Medium Severity
    Show

  • SRG-APP-000343

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must audit the execution of privileged functions.

    &lt;VulnDiscussion&gt;Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external enti...
    Rule Medium Severity
    Show

  • SRG-APP-000345

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must automatically lock the account until the locked account is released by an administrator when three unsuccessful login attempts in 15 minutes are exceeded.

    &lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-APP-000358

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must be configured to transfer UEM server logs to another server for storage, analysis, and reporting. Note: UEM server logs include logs of UEM events and logs transferred to the UEM server by UEM agents of managed devices.

    &lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common...
    Rule Medium Severity
    Show

  • SRG-APP-000374

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must be configured to record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

    &lt;VulnDiscussion&gt;If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analys...
    Rule Medium Severity
    Show

  • SRG-APP-000375

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must be configured to record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

    &lt;VulnDiscussion&gt;Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records....
    Rule Medium Severity
    Show

  • SRG-APP-000378

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must prohibit user installation of software by an administrator without the appropriate assigned permission for software installation.

    &lt;VulnDiscussion&gt;Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malici...
    Rule Medium Severity
    Show

  • SRG-APP-000378

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must be configured to only allow enrolled devices that are compliant with UEM policies and assigned to a user in the application access group to download applications.

    &lt;VulnDiscussion&gt;If the application install policy is not enforced, malicious applications and vulnerable applications can be installed on man...
    Rule Medium Severity
    Show

  • SRG-APP-000380

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must enforce access restrictions associated with changes to the server configuration.

    &lt;VulnDiscussion&gt;Failure to provide logical access restrictions associated with changes to application configuration may have significant effe...
    Rule Medium Severity
    Show

  • SRG-APP-000381

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must audit the enforcement actions used to restrict access associated with changes to the application.

    &lt;VulnDiscussion&gt;Without auditing the enforcement of access restrictions against changes to the application configuration, it will be difficul...
    Rule Medium Severity
    Show

  • SRG-APP-000383

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must disable organization-defined functions, ports, protocols, and services (within the application) deemed unnecessary and/or non-secure.

    &lt;VulnDiscussion&gt;Removal of unneeded or non-secure functions, ports, protocols, and services mitigate the risk of unauthorized connection of d...
    Rule Medium Severity
    Show

  • SRG-APP-000395

    <GroupDescription></GroupDescription>
    Group
    Show

  • Before establishing a connection to any endpoint device being managed, the UEM server must establish a trusted path between the server and endpoint that provides assured identification of the end point using a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.

    &lt;VulnDiscussion&gt;Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authenticati...
    Rule High Severity
    Show

  • SRG-APP-000400

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must prohibit the use of cached authenticators after an organization-defined time period.

    &lt;VulnDiscussion&gt;If cached authentication information is out-of-date, the validity of the authentication information may be questionable. Acc...
    Rule Medium Severity
    Show

  • SRG-APP-000401

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

    &lt;VulnDiscussion&gt;Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer autho...
    Rule Medium Severity
    Show

  • SRG-APP-000412

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.

    &lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote...
    Rule High Severity
    Show

  • SRG-APP-000413

    <GroupDescription></GroupDescription>
    Group
    Show

  • The UEM server must verify remote disconnection when non-local maintenance and diagnostic sessions are terminated.

    &lt;VulnDiscussion&gt;If the remote connection is not closed and verified as closed, the session may remain open and be exploited by an attacker; t...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules