Detections
Analytics

800-53|CM-11(2)

Title

PROHIBIT INSTALLATION WITHOUT PRIVILEGED STATUS

Description

The information system prohibits user installation of software without explicit privileged status.

Supplemental

Privileged status can be obtained, for example, by serving in the role of system administrator.

Reference Item Details

Related: AC-6

Category: CONFIGURATION MANAGEMENT

Parent Title: USER-INSTALLED SOFTWARE

Family: CONFIGURATION MANAGEMENT

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.4.4 Ensure boot loader does not allow removable mediaUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - device_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - unlabeled_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
2.2.21 Ensure the TFTP server has not been installed - TFTP server package installed if not required for operational support.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
3.029 - Print driver installation privilege is not restricted to administrators.WindowsDISA Windows Vista STIG v6r41
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.2.2.6 Ensure rsyslog imudp and imrelp aren't loaded.UnixCIS Amazon Linux 2 STIG v1.0.0 L3
5.3.30 Ensure SSH does not permit GSSAPI - GSSAPI authentication unless needed.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.3.31 Ensure SSH does not permit Kerberos authenticationUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.5.9 Ensure local interactive user accounts umask is 077UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.060 - Media Player must be configured to prevent automatic checking for updates.WindowsDISA Windows Vista STIG v6r41
5.128 - Search Companion prevented from automatically downloading content updates.WindowsDISA Windows Vista STIG v6r41
5.131 - Windows is prevented from using Windows Update to search for drivers.WindowsDISA Windows Vista STIG v6r41
5.211 - Driver Install - Device Driver Search PromptWindowsDISA Windows Vista STIG v6r41
5.242 - Windows Installer - User ControlWindowsDISA Windows Vista STIG v6r41
5.243 - Windows Installer - Vendor Signed UpdatesWindowsDISA Windows Vista STIG v6r41
5.250 - Unsigned gadgets must not be installed. - TurnOffUnsignedGadgetsWindowsDISA Windows Vista STIG v6r41
5.251 - The More Gadgets link must be disabled.WindowsDISA Windows Vista STIG v6r41
5.252 - User-installed gadgets must be turned off.WindowsDISA Windows Vista STIG v6r41
18.9.18.1 Ensure 'Turn off desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
18.9.18.1 Ensure 'Turn off desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
18.9.18.2 Ensure 'Turn Off user-installed desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
18.9.18.2 Ensure 'Turn Off user-installed desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
AOSX-13-362149 - The macOS system must prohibit user installation of software without explicit privileged status.UnixDISA STIG Apple Mac OSX 10.13 v2r5
AOSX-14-002067 - The macOS system must prohibit user installation of software without explicit privileged status.UnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-15-002067 - The macOS system must prohibit user installation of software without explicit privileged status.UnixDISA STIG Apple Mac OSX 10.15 v1r10
APPL-11-002067 - The macOS system must prohibit user installation of software without explicit privileged status.UnixDISA STIG Apple macOS 11 v1r5
APPL-11-002067 - The macOS system must prohibit user installation of software without explicit privileged status.UnixDISA STIG Apple macOS 11 v1r8
APPL-14-005080 - The macOS system must prohibit user installation of software into /users/.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-15-005080 - The macOS system must prohibit user installation of software into /users/.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - 800-171
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Enable Parental ControlsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Prohibit User Installation of Software into /Users/UnixNIST macOS Big Sur v1.4.0 - All Profiles
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - 800-53r4 Moderate
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - 800-53r5 High
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - 800-53r5 Moderate
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - CNSSI 1253
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - 800-171
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - 800-53r4 High
Catalina - Enable Parental ControlsUnixNIST macOS Catalina v1.5.0 - All Profiles
Catalina - Prohibit User Installation of Software into /Users/UnixNIST macOS Catalina v1.5.0 - All Profiles
CD12-00-008400 - PostgreSQL must prohibit user installation of logic modules (functions, trigger procedures, views, etc.) without explicit privileged status.UnixDISA STIG Crunchy Data PostgreSQL OS v3r1
CNTR-R2-001270 Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.UnixDISA Rancher Government Solutions RKE2 STIG v2r2
DB2X-00-008000 - DB2 must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged statusIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.UnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2