Skip to content
Log In

III - Administrative Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-OS-000255

    Group
    Show

  • The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.

    Enabling the audit system will produce records with accurate time stamps, source, user, and activity information. Without this information malicious activity cannot be accurately tracked.
    Rule Medium Severity
    Show

  • SRG-OS-000054

    Group
    Show

  • The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

    Without an audit reporting capability, users find it difficult to identify specific patterns of attack.
    Rule Medium Severity
    Show

  • SRG-OS-000062

    Group
    Show

  • The audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account. Without accurate time stamps, source, user, and ...
    Rule Medium Severity
    Show

  • SRG-OS-000064

    Group
    Show

  • The operating system must generate audit records for the selected list of auditable events as defined in DoD list of events.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account. Without accurate time stamps, source, user, and ...
    Rule Medium Severity
    Show

  • SRG-OS-000037

    Group
    Show

  • Audit records must include what type of events occurred.

    Without proper system auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
    Rule Medium Severity
    Show

  • SRG-OS-000038

    Group
    Show

  • Audit records must include when (date and time) the events occurred.

    Without accurate time stamps malicious activity cannot be accurately tracked.
    Rule Medium Severity
    Show

  • SRG-OS-000039

    Group
    Show

  • Audit records must include where the events occurred.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account. Without accurate time stamps, source, user, and ...
    Rule Medium Severity
    Show

  • SRG-OS-000040

    Group
    Show

  • Audit records must include the sources of the events that occurred.

    Without accurate source information malicious activity cannot be accurately tracked.
    Rule Medium Severity
    Show

  • SRG-OS-000041

    Group
    Show

  • Audit records must include the outcome (success or failure) of the events that occurred.

    Tracking both the successful and unsuccessful attempts aids in identifying threats to the system.
    Rule Medium Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The audit system must be configured to audit file deletions.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000004

    Group
    Show

  • The audit system must be configured to audit account creation.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000239

    Group
    Show

  • The audit system must be configured to audit account modification.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000240

    Group
    Show

  • The operating system must automatically audit account disabling actions.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000241

    Group
    Show

  • The operating system must automatically audit account termination.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked.

    Without auditing, malicious activity cannot be detected.
    Rule Medium Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The audit system must be configured to audit all administrative, privileged, and security actions.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
    Rule Medium Severity
    Show

  • SRG-OS-000032

    Group
    Show

  • The audit system must be configured to audit login, logout, and session initiation.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
    Rule Low Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The audit system must be configured to audit failed attempts to access files and programs.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
    Rule Low Severity
    Show

  • SRG-OS-000061

    Group
    Show

  • The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server.

    Keeping audit records on a remote system reduces the likelihood of audit records being changed or corrupted. Duplicating and protecting the audit trail on a separate system reduces the likelihood o...
    Rule Low Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The auditing system must not define a different auditing level for specific users.

    Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.
    Rule Low Severity
    Show

  • SRG-OS-000046

    Group
    Show

  • The operating system must alert designated organizational officials in the event of an audit processing failure.

    Proper alerts to system administrators and IA officials of audit failures ensure a timely response to critical system issues.
    Rule High Severity
    Show

  • SRG-OS-000047

    Group
    Show

  • The operating system must shut down by default upon audit failure (unless availability is an overriding concern).

    Continuing to operate a system without auditing working properly can result in undocumented access or system changes.
    Rule Medium Severity
    Show

  • SRG-OS-000057

    Group
    Show

  • The operating system must protect audit information from unauthorized access.

    If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. T...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    Group
    Show

  • The System packages must be up to date with the most recent vendor updates and security fixes.

    Failure to install security updates can provide openings for attack.
    Rule Medium Severity
    Show

  • SRG-OS-000256

    Group
    Show

  • The operating system must protect audit tools from unauthorized access.

    Failure to maintain system configurations may result in privilege escalation.
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules