Detections
Analytics

800-53|SC-7(5)

Title

DENY BY DEFAULT / ALLOW BY EXCEPTION

Description

The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).

Supplemental

This control enhancement applies to both inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those connections which are essential and approved are allowed.

Reference Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Parent Title: BOUNDARY PROTECTION

Family: SYSTEM AND COMMUNICATIONS PROTECTION

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.5.2.7 Set 'Inbound Connections' to 'Enabled:Block (default)'WindowsCIS Windows 8 L1 v1.0.0
1.1.5.3.11 Set 'Inbound Connections' to 'Enabled:Block (default)'WindowsCIS Windows 8 L1 v1.0.0
1.2.4 Create 'access-list' for use with 'line vty' - 'ACL deny is configured'CiscoCIS Cisco IOS 12 L1 v4.0.0
1.3.2 Disable TCP and UDP small serversCiscoCIS Cisco IOS XR 7.x v1.0.0 L1
1.5.3 Do not set 'RW' for any 'snmp-server community'CiscoCIS Cisco IOS XR 7.x v1.0.0 L1
1.5.6 Create an 'access-list' for use with SNMP - 'SNMP deny secured by ACL'CiscoCIS Cisco IOS 12 L1 v4.0.0
2.1.1 Ensure 'extproc' Is Not Present in 'listener.ora'UnixCIS Oracle Server 19c Linux v1.2.0
2.1.1 Ensure 'extproc' Is Not Present in 'listener.ora'WindowsCIS Oracle Server 19c Windows v1.2.0
2.1.1 Ensure Firewall Is EnabledUnixCIS Apple macOS 14.0 Sonoma Cloud-tailored v1.0.0 L1
2.1.1 Ensure Firewall Is EnabledUnixCIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1
2.1.2 Ensure 'extproc' Is Not Present in 'listener.ora'UnixCIS Oracle Server 18c Linux v1.1.0
2.1.2 Ensure 'extproc' Is Not Present in 'listener.ora'WindowsCIS Oracle Server 18c Windows v1.1.0
2.1.2 Ensure Firewall Stealth Mode Is EnabledUnixCIS Apple macOS 14.0 Sonoma Cloud-tailored v1.0.0 L1
2.1.4 Ensure rsync service is not enabledUnixCIS Google Container-Optimized OS v1.2.0 L1 Server
2.2 Disable Local-only Graphical Login EnvironmentUnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.2.1 Ensure Firewall Is EnabledUnixCIS Apple macOS 13.0 Ventura v3.0.0 L1
2.2.1 Ensure Firewall Is EnabledUnixCIS Apple macOS 14.0 Sonoma v2.0.0 L1
2.2.2 Ensure Firewall Stealth Mode Is EnabledUnixCIS Apple macOS 15.0 Sequoia v1.0.0 L1
2.2.2 Ensure Firewall Stealth Mode Is EnabledUnixCIS Apple macOS 13.0 Ventura v3.0.0 L1
2.2.2 Ensure Firewall Stealth Mode Is EnabledUnixCIS Apple macOS 14.0 Sonoma v2.0.0 L1
2.2.5 Ensure 'REMOTE_LISTENER' Is EmptyOracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
2.2.5 Ensure 'REMOTE_LISTENER' Is EmptyOracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
2.3 Configure sendmail Service for Local-Only ModeUnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.4 Configure TCP Wrappers - Allow localhost.UnixCIS Solaris 10 L1 v5.2
2.4 Configure TCP Wrappers - Deny access to this server from all networksUnixCIS Solaris 10 L1 v5.2
2.4 Disable RPC Encryption KeyUnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'MS_SQLDBCIS Microsoft SQL Server 2019 v1.4.0 L1 AWS RDS
2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'MS_SQLDBCIS Microsoft SQL Server 2019 v1.4.0 L1 Database Engine
2.5 Disable Generic Security Services (GSS)UnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.6 Disable Apache ServiceUnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.7 Disable Kerberos TGT Expiration WarningUnixCIS Oracle Solaris 11.4 L1 v1.1.0
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS SQL Server 2016 Database L1 AWS RDS v1.4.0
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS SQL Server 2022 Database L1 DB v1.1.0
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS SQL Server 2017 Database L1 AWS RDS v1.3.0
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS Microsoft SQL Server 2019 v1.4.0 L1 Database Engine
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS SQL Server 2017 Database L1 DB v1.3.0
2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'MS_SQLDBCIS SQL Server 2016 Database L1 DB v1.4.0
2.10.2 - TCP Wrappers - creating a hosts.deny file - configuration - 'hosts.deny file contains ALL:ALL'UnixCIS AIX 5.3/6.1 L1 v1.1.0
2.10.3 - TCP Wrappers - creating a hosts.allow file - configuration - 'hosts.allow has been configured'UnixCIS AIX 5.3/6.1 L1 v1.1.0
2.11 Configure TCP Wrappers - hosts.allowUnixCIS Solaris 11.1 L1 v1.0.0
2.11 Configure TCP Wrappers - hosts.denyUnixCIS Solaris 11.1 L1 v1.0.0
2.12 Configure TCP Wrappers - hosts.allowUnixCIS Solaris 11 L1 v1.1.0
2.12 Configure TCP Wrappers - hosts.denyUnixCIS Solaris 11 L1 v1.1.0
2.12 Disable Telnet ServiceUnixCIS Oracle Solaris 11.4 L1 v1.1.0
10.1 Ensure Unused Features are RemovedUnixCIS IBM WebSphere Liberty v1.0.0 L1
10.2 SN.2 Remove Support for Internet Services (inetd)UnixCIS Oracle Solaris 11.4 L2 v1.1.0
20.31 Ensure 'Host-based firewall is installed and enabled'WindowsCIS Microsoft Windows Server 2016 STIG v3.0.0 STIG DC
20.31 Ensure 'Host-based firewall is installed and enabled'WindowsCIS Microsoft Windows Server 2016 STIG v3.0.0 STIG MS
20.31 Ensure 'Host-based firewall is installed and enabled'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 STIG DC
20.31 Ensure 'Host-based firewall is installed and enabled'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 STIG MS