800-53|AC-17(1)

Title

AUTOMATED MONITORING / CONTROL

Description

The information system monitors and controls remote access methods.

Supplemental

Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

Reference Item Details

Related: AU-12,AU-2

Category: ACCESS CONTROL

Parent Title: REMOTE ACCESS

Family: ACCESS CONTROL

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.6.1 Ensure 'SSH source restriction' is set to an authorized IP addressCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
1.6.2 Ensure 'SSH version 2' is enabledCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
2.2.32 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2016 STIG v3.0.0 STIG MS
2.2.34 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2022 STIG v1.0.0 STIG MS
2.2.35 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 STIG MS
2.7 Ensure TLS authentication for Docker daemon is configuredUnixCIS Docker v1.7.0 L1 Docker - Linux
2.8.1 Ensure 'Allow remote access connections to this machine' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.2 Ensure 'Allow remote users to interact with elevated windows in remote assistance sessions' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.3 Ensure 'Configure the required domain names for remote access clients' is set to 'Enabled' with a domain definedWindowsCIS Google Chrome L1 v3.0.0
2.8.4 Ensure 'Enable curtaining of remote access hosts' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.5 Ensure 'Enable firewall traversal from remote access host' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.6 Ensure 'Enable or disable PIN-less authentication for remote access hosts' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.7 Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'.WindowsCIS Google Chrome L1 v3.0.0
2.32 Ensure 'Allow remote debugging' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
3.2 Ensure 'Allow unmanaged devices' is set to 'False'WindowsCIS Microsoft Exchange Server 2019 L1 MDM v1.0.0
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.5.3.2.3 Ensure iptables rules exist for all open ports - PPSM CLSA and vulnerability assessments.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
3.9 Ensure 'Require encryption on device' is set to 'True'WindowsCIS Microsoft Exchange Server 2019 L1 MDM v1.0.0
4.8 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Accessmicrosoft_azureCIS Microsoft Azure Foundations v3.0.0 L2
4.10 (L1) Host must verify certificates for TLS remote logging endpointsVMwareCIS VMware ESXi 8.0 v1.1.0 L1
4.11 (L1) Host must use strict x509 verification for TLS-enabled remote logging endpointsVMwareCIS VMware ESXi 8.0 v1.1.0 L1
5.1.1 Enable Compromised Host QuarantineFortiGateCIS Fortigate 7.0.x v1.3.0 L1
5.117 - Users must be prevented from connecting using Terminal Services.WindowsDISA Windows Vista STIG v6r41
AIOS-12-011200 - Apple iOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS 12 v2r1
AIOS-12-011200 - Apple iOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS 12 v2r1
AIOS-13-011200 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 13 v2r1
AIOS-13-011200 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 13 v2r1
AIOS-14-009400 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 14 v1r3
AIOS-14-009400 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 14 v1r3
AIOS-16-011000 - Apple iOS/iPadOS 16 must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 16 v2r1
AIOS-16-011000 - Apple iOS/iPadOS 16 must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 16 v2r1
AIOS-17-011000 - Apple iOS/iPadOS 17 must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 17 v2r1
AIOS-17-011000 - Apple iOS/iPadOS 17 must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 17 v2r1
AIOS-18-010900 - Apple iOS/iPadOS 18 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.MDMAirWatch - DISA Apple iOS/iPadOS 18 v1r1
AIOS-18-010900 - Apple iOS/iPadOS 18 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.MDMMobileIron - DISA Apple iOS/iPadOS 18 v1r1
AIOS-18-010950 - Apple iOS/iPadOS 18 must implement the management setting: require passcode for incoming Airplay connection requests.MDMAirWatch - DISA Apple iOS/iPadOS 18 v1r1
AIOS-18-010950 - Apple iOS/iPadOS 18 must implement the management setting: require passcode for incoming Airplay connection requests.MDMMobileIron - DISA Apple iOS/iPadOS 18 v1r1
AIOS-18-011000 - Apple iOS/iPadOS 18 must implement the management setting: disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 18 v1r1
AIOS-18-011000 - Apple iOS/iPadOS 18 must implement the management setting: disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 18 v1r1