Audits
Settings
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Theme
Light
Dark
Auto
Help
Plugins
Overview
Plugins Pipeline
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Release Notes
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Settings
Theme
Light
Dark
Auto
Detections
Plugins
Overview
Plugins Pipeline
Release Notes
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
Analytics
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Audits
References
CCI
CCI-001941
CCI
CCI|CCI-001941
Title
Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
Reference Item Details
Reference:
CCI - DISA Control Correlation Identifier
Category:
2024
Audit Items
View all Reference Audit Items
Name
Plugin
Audit Name
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Unix
DISA STIG AIX 7.x v3r1
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Unix
DISA STIG Apple Mac OSX 10.13 v2r5
APPL-11-000011 - The macOS system must disable the SSHD service.
Unix
DISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.
Unix
DISA STIG Apple macOS 11 v1r5
APPL-14-001150 - The macOS system must disable password authentication for SSH.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-003020 - The macOS system must enforce smart card authentication.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-003030 - The macOS system must allow smart card authentication.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-003050 - The macOS system must enforce multifactor authentication for logon.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-003051 - The macOS system must enforce multifactor authentication for the su command.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-003052 - The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-15-001150 - The macOS system must disable password authentication for SSH.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003020 - The macOS system must enforce smart card authentication.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003030 - The macOS system must allow smart card authentication.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003050 - The macOS system must enforce multifactor authentication for login.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003051 - The macOS system must enforce multifactor authentication for the su command.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003052 - The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
ARST-ND-000690 - The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Arista
DISA STIG Arista MLS EOS 4.2x NDM v2r1
CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.
Cisco
DISA STIG Cisco ASA NDM v2r2
Catalina - Enable SSH for Remote Access Sessions
Unix
NIST macOS Catalina v1.5.0 - All Profiles
CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.
Cisco
DISA STIG Cisco IOS-XR Router NDM v3r2
CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.
Cisco
DISA STIG Cisco NX-OS Switch NDM v3r2
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Cisco
DISA STIG Cisco IOS Router NDM v3r2
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Cisco
DISA STIG Cisco IOS XE Router NDM v3r2
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Cisco
DISA STIG Cisco IOS XE Switch NDM v3r2
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Cisco
DISA STIG Cisco IOS Switch NDM v3r2
DKER-EE-001070 - FIPS mode must be enabled on all Docker Engine - Enterprise nodes - docker info .SecurityOptions
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
EDGE-00-000062 - The built-in DNS client must be disabled.
Windows
DISA STIG Edge v2r2
ESXI-06-200037 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using Active Directory for local user authentication.
VMware
DISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200038 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using the vSphere Authentication Proxy.
VMware
DISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200039 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by restricting use of Active Directory ESX Admin group membership.
VMware
DISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.
VMware
DISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.
VMware
DISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.
VMware
DISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-70-000037 - The ESXi host must use Active Directory for local user authentication.
VMware
DISA STIG VMware vSphere 7.0 ESXi v1r2
ESXI-80-000049 The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.
VMware
DISA VMware vSphere 8.0 ESXi STIG v2r1
FGFW-ND-000205 - The FortiGate device must implement replay-resistant authentication mechanisms for network access to privileged accounts
FortiGate
DISA Fortigate Firewall NDM STIG v1r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.
Unix
DISA STIG Solaris 10 X86 v2r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.
Unix
DISA STIG Solaris 10 SPARC v2r4
JUEX-NM-000260 - The Juniper EX switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.
Juniper
DISA Juniper EX Series Network Device Management v2r2
JUNI-ND-000530 - The Juniper router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.
Juniper
DISA STIG Juniper Router NDM v3r1
JUSX-DM-000124 - The Juniper SRX Services Gateway must implement replay-resistant authentication mechanisms for network access to privileged accounts.
Juniper
DISA Juniper SRX Services Gateway NDM v3r2
JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.
Juniper
DISA Juniper SRX Services Gateway VPN v3r1
PANW-NM-000051 - The Palo Alto Networks security platform must implement replay-resistant authentication mechanisms for network access to privileged accounts.
Palo_Alto
DISA STIG Palo Alto NDM v3r2
PHTN-30-000026 - The Photon operating system must use an OpenSSH server version that does not support protocol 1.
Unix
DISA STIG VMware vSphere 7.0 Photon OS v1r3
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.
Unix
DISA STIG VMware vSphere 6.7 Photon OS v1r6
RHEL-06-000227 - The SSH daemon must be configured to use only the SSHv2 protocol.
Unix
DISA Red Hat Enterprise Linux 6 STIG v2r2
RHEL-09-611160 - RHEL 9 must use the common access card (CAC) smart card driver.
Unix
DISA Red Hat Enterprise Linux 9 STIG v2r2
SHPT-00-000530 - The Central Administration Web Application must use Kerberos as the authentication provider.
Windows
DISA STIG SharePoint 2010 v1r9
SHPT-00-000531 - SharePoint sites must not use NTLM - SharePoint sites must not use NTLM.
Windows
DISA STIG SharePoint 2010 v1r9
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
Unix
DISA STIG Solaris 11 X86 v3r1
