800-53|AC-5

Title

SEPARATION OF DUTIES

Description

The organization:

Supplemental

Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions.

Reference Item Details

Related: AC-3,AC-6,PE-3,PE-4,PS-2

Category: ACCESS CONTROL

Family: ACCESS CONTROL

Priority: P1

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictiveUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictiveOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L1
1.1.10 Ensure nodev option set on /dev/shm partitionUnixCIS Google Container-Optimized OS L1 Server v1.1.0
1.1.10 Ensure noexec option set on /var/tmp partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.1
1.1.10 Ensure noexec option set on /var/tmp partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1
1.1.10 Ensure separate partition exists for /varUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server
1.1.10 Ensure separate partition exists for /varUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Workstation
1.1.11 Ensure nosuid option set on /dev/shm partitionUnixCIS Google Container-Optimized OS L1 Server v1.1.0
1.1.11 Ensure separate partition exists for /var/tmpUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Workstation
1.1.11 Ensure separate partition exists for /var/tmpUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L1
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.12 Ensure /var/tmp partition includes the noexec optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server
1.1.12 Ensure /var/tmp partition includes the noexec optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcdUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcdUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcdUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcdUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.13 Ensure /var/tmp partition includes the nodev optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server
1.1.13 Ensure /var/tmp partition includes the nodev optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation
1.1.13 Ensure that the admin.conf file permissions are set to 600UnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.13 Ensure that the admin.conf file permissions are set to 600UnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.13 Ensure that the default administrative credential file permissions are set to 600UnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.1.13 Ensure that the kubeconfig file permissions are set to 600 or more restrictiveOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L1
1.1.14 Ensure /var/tmp partition includes the nosuid optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server
1.1.14 Ensure /var/tmp partition includes the nosuid optionUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation
1.1.14 Ensure nodev option set on /home partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.1
1.1.14 Ensure nodev option set on /home partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1
1.1.15 Ensure nodev option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1
1.1.15 Ensure nodev option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.1
1.1.15 Ensure that the Scheduler kubeconfig file permissions are set to 600 or more restrictiveOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L1
1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.16 Ensure nosuid option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.1
1.1.16 Ensure nosuid option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1
1.1.17 Ensure noexec option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1
1.1.17 Ensure noexec option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.1
1.1.17 Ensure that the Controller Manager kubeconfig file permissions are set to 600 or more restrictiveOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L1
1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictiveUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
1.02 Windows Oracle Local Account - 'Use Restricted Service Account (RSA)'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1