800-53|SI-5

Title

SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

Description

The organization:

Supplemental

The United States Computer Emergency Readiness Team (US-CERT) generates security alerts and advisories to maintain situational awareness across the federal government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance to security directives is essential due to the critical nature of many of these directives and the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include, for example, external mission/business partners, supply chain partners, external service providers, and other peer/supporting organizations.

Reference Item Details

Related: SI-2

Category: SYSTEM AND INFORMATION INTEGRITY

Family: SYSTEM AND INFORMATION INTEGRITY

Priority: P1

Baseline Impact: LOW,MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.1.2.1.45 Set 'Microsoft network client: Send unencrypted password to third-party SMB servers' to 'Disabled'WindowsCIS Windows 2003 DC v3.1.0
1.1.1.2.1.45 Set 'Microsoft network client: Send unencrypted password to third-party SMB servers' to 'Disabled'WindowsCIS Windows 2003 MS v3.1.0
1.1.3.7.1 Set 'Microsoft network client: Send unencrypted password to third-party SMB servers' to 'Disabled'WindowsCIS Windows 8 L1 v1.0.0
1.9.32 Microsoft network client: Send unencrypted password to third-party SMB serversWindowsCIS Windows 2008 Enterprise v1.2.0
1.9.32 Microsoft network client: Send unencrypted password to third-party SMB serversWindowsCIS Windows 2008 SSLF v1.2.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2016 MS L1 v1.2.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 DC L1 v2.4.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 DC L1 v2.5.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 Member Server Level 1 v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 Domain Controller Level 1 v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2016 DC L1 v1.2.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows 8.1 L1 Bitlocker v2.3.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 DC L1 v2.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.1.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Microsoft Windows 8.1 L1 v2.3.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 MS L1 v2.4.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 MS L1 v2.5.0
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'WindowsCIS Windows Server 2012 MS L1 v2.1.0
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.WindowsDISA Windows Server 2008 DC STIG v6r47
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.WindowsDISA Windows Server 2008 MS STIG v6r46
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.WindowsDISA Windows Server 2008 R2 DC STIG v1r34
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.WindowsDISA Windows 7 STIG v1r32
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.WindowsDISA Windows Server 2008 R2 MS STIG v1r33
18.3.5 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows 8.1 L1 v2.3.0
18.3.5 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows 8.1 L1 Bitlocker v2.3.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 MS L1 v2.5.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 DC L1 v2.1.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.1.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 v3.1.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 DC L1 v2.5.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.1.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.1.0
18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 MS L1 v2.1.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2016 DC L1 v1.2.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 MS L1 v2.4.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Microsoft Windows Server 2016 MS L1 v1.2.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows Server 2012 R2 DC L1 v2.4.0
18.3.7 Ensure 'WDigest Authentication' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
18.9.77.7.1 (L1) Ensure 'Turn on behavior monitoring' is set to 'Enabled'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
18.9.77.7.1 Ensure 'Turn on behavior monitoring' is set to 'Enabled'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
18.10.15.6 (L1) Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 L1 MS
18.10.15.6 (L1) Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 L1 DC
18.10.15.6 Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2022 STIG v1.0.0 L1 DC
18.10.15.6 Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2022 STIG v1.0.0 L1 MS