I - Mission Critical Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000108
Group -
The operating system must use multifactor authentication for local access to nonprivileged accounts.
To ensure accountability, prevent unauthenticated access, and prevent misuse of the system, nonprivileged users must utilize multifactor authentication for local access. Multifactor authentication...Rule Medium Severity -
SRG-OS-000109
Group -
The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.
To ensure individual accountability and prevent unauthorized access, organizational users must be individually identified and authenticated. A group authenticator is a generic account used by mult...Rule Medium Severity -
SRG-OS-000112
Group -
The operating system must implement replay-resistant authentication mechanisms for network access to privileged accounts.
A replay attack may enable an unauthorized user to gain access to the operating system. Authentication sessions between the authenticator and the operating system validating the user credentials mu...Rule Medium Severity -
SRG-OS-000113
Group -
The operating system must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
A replay attack may enable an unauthorized user to gain access to the operating system. Authentication sessions between the authenticator and the operating system validating the user credentials mu...Rule Medium Severity -
SRG-OS-000114
Group -
The operating system must uniquely identify peripherals before establishing a connection.
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drives, ...Rule Medium Severity -
SRG-OS-000118
Group -
The operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts...Rule Medium Severity -
SRG-OS-000120
Group -
The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be ...Rule Medium Severity -
SRG-OS-000121
Group -
The operating system must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Lack of authentication and identification enables non-organizational users to gain access to the application or possibly other information systems and provides an opportunity for intruders to compr...Rule Medium Severity -
SRG-OS-000122
Group -
The operating system must provide an audit reduction capability that supports on-demand reporting requirements.
The ability to generate on-demand reports, including after the audit data has been subjected to audit reduction, greatly facilitates the organization's ability to generate incident reports as neede...Rule Medium Severity -
SRG-OS-000123
Group -
The information system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.
Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.