CISC-ND-000010 - The Cisco switch must be configured to limit the number of concurrent management sessions to an organization-defined number.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-110595r1_rule

STIG-ID|CISC-ND-000010

Vuln-ID|V-101491

CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation. - aaa accounting default group

800-53|AU-12

CCI|CCI-000018

Rule-ID|SV-110597r1_rule

STIG-ID|CISC-ND-000090

Vuln-ID|V-101493

CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation. - servers

800-53|AU-10

CISC-ND-000100 - The Cisco switch must be configured to automatically audit account modification. - aaa accounting default group

CCI|CCI-001403

Rule-ID|SV-110599r1_rule

STIG-ID|CISC-ND-000100

Vuln-ID|V-101495

CISC-ND-000100 - The Cisco switch must be configured to automatically audit account modification. - servers

CISC-ND-000110 - The Cisco switch must be configured to automatically audit account disabling actions. - aaa accounting default group

CCI|CCI-001404

Rule-ID|SV-110601r1_rule

STIG-ID|CISC-ND-000110

Vuln-ID|V-101497

CISC-ND-000110 - The Cisco switch must be configured to automatically audit account disabling actions. - servers

CISC-ND-000120 - The Cisco switch must be configured to automatically audit account removal actions. - aaa accounting default group

CCI|CCI-001405

Rule-ID|SV-110603r1_rule

STIG-ID|CISC-ND-000120

Vuln-ID|V-101499

CISC-ND-000120 - The Cisco switch must be configured to automatically audit account removal actions. - servers

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line vty access-class

CCI|CCI-001368

Rule-ID|SV-110605r1_rule

STIG-ID|CISC-ND-000140

Vuln-ID|V-101501

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - management access-list

CISC-ND-000150 - The Cisco switch must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-110607r1_rule

STIG-ID|CISC-ND-000150

Vuln-ID|V-101503

CISC-ND-000160 - The Cisco switch must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-110609r1_rule

STIG-ID|CISC-ND-000160

Vuln-ID|V-101505

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - aaa accounting default group

CCI|CCI-000166

Rule-ID|SV-110611r1_rule

STIG-ID|CISC-ND-000210

Vuln-ID|V-101507

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - servers

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-failure log

CCI|CCI-000172

Rule-ID|SV-110615r1_rule

STIG-ID|CISC-ND-000250

Vuln-ID|V-101511

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-success log

CISC-ND-000290 - The Cisco switch must produce audit records containing information to establish where the events occurred. - ip access-list

CCI|CCI-000132

Rule-ID|SV-110617r1_rule

STIG-ID|CISC-ND-000290

Vuln-ID|V-101513

CISC-ND-000290 - The Cisco switch must produce audit records containing information to establish where the events occurred. - logging ip

800-53|AU-3

CISC-ND-000330 - The Cisco switch must be configured to generate audit records containing the full-text recording of privileged commands. - aaa accounting default group

CCI|CCI-000135

Rule-ID|SV-110619r1_rule

STIG-ID|CISC-ND-000330

Vuln-ID|V-101515

CISC-ND-000330 - The Cisco switch must be configured to generate audit records containing the full-text recording of privileged commands. - servers

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - boot network

800-53|SI-7(9)

CAT|I

CCI|CCI-000382

Rule-ID|SV-110621r1_rule

STIG-ID|CISC-ND-000470

Vuln-ID|V-101517

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - ip boot server

800-53|CM-7

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa authentication login default fallback

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-110623r1_rule

STIG-ID|CISC-ND-000490

Vuln-ID|V-101519

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa authentication login default group

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - account

CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ip ssh version 2

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-110625r1_rule

STIG-ID|CISC-ND-000530

Vuln-ID|V-101521

CISC-ND-000570 - The Cisco switch must be configured to enforce password complexity by requiring that at least one upper-case character be used.

800-53|IA-5(1)

CCI|CCI-000192

Rule-ID|SV-110627r1_rule

STIG-ID|CISC-ND-000570

Vuln-ID|V-101523

CISC-ND-000580 - The Cisco switch must be configured to enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-110629r1_rule

STIG-ID|CISC-ND-000580

Vuln-ID|V-101525

CISC-ND-000590 - The Cisco switch must be configured to enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-110631r1_rule

STIG-ID|CISC-ND-000590

Vuln-ID|V-101527

CISC-ND-000600 - The Cisco switch must be configured to enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-110633r1_rule

STIG-ID|CISC-ND-000600

Vuln-ID|V-101529

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line con

800-53|AC-12

CCI|CCI-001133

CSCv6|16.4

Rule-ID|SV-110635r1_rule

STIG-ID|CISC-ND-000720

Vuln-ID|V-101531

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line vty

CISC-ND-000880 - The Cisco switch must be configured to automatically audit account enabling actions. - aaa accounting default group

CCI|CCI-002130

Rule-ID|SV-110637r1_rule

STIG-ID|CISC-ND-000880

Vuln-ID|V-101533

CISC-ND-000880 - The Cisco switch must be configured to automatically audit account enabling actions. - servers

CISC-ND-000940 - The Cisco switch must be configured to audit the execution of privileged functions - aaa accounting default group

CCI|CCI-002234

Rule-ID|SV-110639r1_rule

STIG-ID|CISC-ND-000940

Vuln-ID|V-101535

CISC-ND-000940 - The Cisco switch must be configured to audit the execution of privileged functions - servers

CISC-ND-000980 - The Cisco switch must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-110641r1_rule

STIG-ID|CISC-ND-000980

Vuln-ID|V-101537

CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events.

CCI|CCI-001858

Rule-ID|SV-110643r1_rule

STIG-ID|CISC-ND-001000

Vuln-ID|V-101539

CISC-ND-001030 - The Cisco switch must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. - feature ntp

800-53|AU-8(2)

800-53|CM-6

CCI|CCI-000366

CCI|CCI-001893

Rule-ID|SV-110645r1_rule

STIG-ID|CISC-ND-001030

Vuln-ID|V-101541

CISC-ND-001030 - The Cisco switch must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. - ntp commit

CISC-ND-001030 - The Cisco switch must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. - ntp distribute

CISC-ND-001030 - The Cisco switch must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. - ntp servers

800-53|AU-8(1)

CISC-ND-001050 - The Cisco switch must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

800-53|AU-8

CCI|CCI-001890

Rule-ID|SV-110647r1_rule

STIG-ID|CISC-ND-001050

Vuln-ID|V-101543

CISC-ND-001130 - The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - show snmp user

800-53|IA-3(1)

CCI|CCI-001967

Rule-ID|SV-110649r1_rule

STIG-ID|CISC-ND-001130

Vuln-ID|V-101545

CISC-ND-001130 - The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server host

CISC-ND-001130 - The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server user md5

CISC-ND-001130 - The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server user sha

CISC-ND-001140 - The Cisco switch must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server user aes-128

CCI|CCI-000068

Rule-ID|SV-110651r1_rule

STIG-ID|CISC-ND-001140

Vuln-ID|V-101547

CISC-ND-001140 - The Cisco switch must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server user non aes-128

800-53|AC-17(2)

CISC-ND-001150 - The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based - ntp authenticate

Rule-ID|SV-110653r1_rule

STIG-ID|CISC-ND-001150

Vuln-ID|V-101549

CISC-ND-001150 - The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based - ntp authentication-key

CSCv6|3.1

CISC-ND-001150 - The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based - ntp commit

CISC-ND-001150 - The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based - ntp server

CISC-ND-001150 - The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based - ntp trusted-key

800-53|IA-3

CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-110655r1_rule

STIG-ID|CISC-ND-001200

Vuln-ID|V-101551

CISC-ND-001210 - The Cisco switch must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

Detections

Analytics

DISA STIG Cisco NX-OS Switch NDM v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous