Detections
Analytics

CCI|CCI-001942

Title

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.130 SOL-11.1-050240UnixCIS Solaris 11 X86 STIG v1.0.0 CAT II
1.132 SOL-11.1-050240UnixCIS Solaris 11 SPARC STIG v1.0.0 CAT II
1.147 WN16-DC-000020WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.148 WN16-DC-000030WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.148 WN19-DC-000020WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.148 WN22-DC-000020WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.149 WN16-DC-000040WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.149 WN19-DC-000030WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.149 WN22-DC-000030WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.150 WN16-DC-000050WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.150 WN19-DC-000040WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.150 WN22-DC-000040WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.151 WN16-DC-000060WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.151 WN19-DC-000050WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.151 WN22-DC-000050WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.152 WN19-DC-000060WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.152 WN22-DC-000060WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.339 RHEL-09-611160UnixCIS Red Hat Enterprise Linux 9 STIG v1.0.0 CAT II
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.UnixDISA IBM AIX 7.x STIG v3r2
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
ARBA-VN-002220 - AOS, when used as an IPsec VPN Gateway, must use Internet Key Exchange (IKE) for IPsec VPN security associations (SAs).ArubaOSDISA HPE Aruba Networking AOS VPN STIG v1r1
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v2r3
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA Microsoft Edge STIG v2r5
ESXI-06-300037 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using Active Directory for local user authentication.VMwareDISA VMware vSphere ESXi 6.0 STIG v1r5
ESXI-06-300038 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using the vSphere Authentication Proxy.VMwareDISA VMware vSphere ESXi 6.0 STIG v1r5
ESXI-06-300039 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA VMware vSphere ESXi 6.0 STIG v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-70-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA VMware vSphere 7.0 ESXi STIG v1r4 VMware
ESXI-80-000049 - The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.VMwareDISA VMware vSphere 8.0 ESXi STIG v2r3 VMware
ESXI-80-000049 - The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.VMwareDISA VMware vSphere 8.0 ESXi STIG v2r3 VMware
JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.JuniperDISA Juniper SRX Services Gateway VPN v3r2
PHTN-30-000026 - The Photon operating system must use an OpenSSH server version that does not support protocol 1.UnixDISA STIG VMware vSphere 7.0 Photon OS v1r4
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r6
RHEL-09-611160 - RHEL 9 must use the common access card (CAC) smart card driver.UnixDISA Red Hat Enterprise Linux 9 STIG v2r8
SLEM-05-255010 - SLEM 5 must have SSH installed to protect the confidentiality and integrity of transmitted information.UnixDISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).UnixDISA Solaris 11 X86 STIG v3r5
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).UnixDISA Solaris 11 SPARC STIG v3r5
SYMP-AG-000380 - Symantec ProxySG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.BlueCoatDISA Symantec ProxySG Benchmark ALG v1r3
UBTU-16-030200 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-18-010412 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 18.04 LTS v2r15
VCSA-70-000009 - The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.VMwareDISA STIG VMware vSphere 7.0 vCenter v1r3
WN12-AC-000014-DC - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2012 and 2012 R2 DC STIG v3r7
WN16-DC-000020 - Kerberos user logon restrictions must be enforced.WindowsDISA Microsoft Windows Server 2016 STIG v2r10
WN16-DC-000030 - The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Microsoft Windows Server 2016 STIG v2r10
WN16-DC-000040 - The Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Microsoft Windows Server 2016 STIG v2r10