Detections
Analytics

CCI|CCI-001941

Title

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
ARST-ND-000690 - The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.AristaDISA STIG Arista MLS EOS 4.2x NDM v2r1
CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA STIG Cisco ASA NDM v2r2
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA STIG Cisco IOS-XR Router NDM v3r2
CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA STIG Cisco NX-OS Switch NDM v3r2
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS Router NDM v3r2
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS XE Router NDM v3r2
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS XE Switch NDM v3r2
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS Switch NDM v3r2
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v2r2
ESXI-06-200039 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 X86 v2r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 SPARC v2r4
JUEX-NM-000260 - The Juniper EX switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.JuniperDISA Juniper EX Series Network Device Management v2r2
JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.JuniperDISA Juniper SRX Services Gateway VPN v3r1
PHTN-30-000026 - The Photon operating system must use an OpenSSH server version that does not support protocol 1.UnixDISA STIG VMware vSphere 7.0 Photon OS v1r3
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r6
RHEL-06-000227 - The SSH daemon must be configured to use only the SSHv2 protocol.UnixDISA Red Hat Enterprise Linux 6 STIG v2r2
RHEL-09-611160 - RHEL 9 must use the common access card (CAC) smart card driver.UnixDISA Red Hat Enterprise Linux 9 STIG v2r2
SYMP-NM-000230 - Symantec ProxySG must implement HTTPS-console to provide replay-resistant authentication mechanisms for network access to privileged accounts. - HTTP-ConsoleBlueCoatDISA Symantec ProxySG Benchmark NDM v1r2
SYMP-NM-000230 - Symantec ProxySG must implement HTTPS-console to provide replay-resistant authentication mechanisms for network access to privileged accounts. - HTTPS-ConsoleBlueCoatDISA Symantec ProxySG Benchmark NDM v1r2
UBTU-16-030200 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-18-010412 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 18.04 LTS v2r15
WN12-AC-000014-DC - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2012 and 2012 R2 DC STIG v3r7
WN16-DC-000020 - Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2016 STIG v2r9
WN16-DC-000050 - The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2016 STIG v2r9
WN19-DC-000050 - Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2019 STIG v3r2
WN22-DC-000020 - Windows Server 2022 Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2022 STIG v2r2
WN22-DC-000050 - Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2022 STIG v2r2
WN22-DC-000060 - Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.WindowsDISA Windows Server 2022 STIG v2r2