Detections
Analytics

CCI|CCI-004866

Title

Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
ARST-L2-000030 - The Arista MLS layer 2 switch must be configured for Storm Control to limit the effects of packet flooding types of denial-of-service (DoS) attacks.AristaDISA STIG Arista MLS EOS 4.2x L2S v2r1
CASA-FW-000150 - The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.CiscoDISA STIG Cisco ASA FW v2r1
CISC-L2-000040 - The Cisco switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks - DoS attacks.CiscoDISA STIG Cisco IOS XE Switch L2S v3r1
CISC-L2-000040 - The Cisco switch must manage excess bandwidth to limit the effects of packet-flooding types of denial-of-service (DoS) attacks.CiscoDISA STIG Cisco IOS Switch L2S v3r1
CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.CiscoDISA STIG Cisco IOS XE Router RTR v3r1
CISC-RT-000120 - The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.CiscoDISA STIG Cisco IOS Router RTR v3r1
CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.CiscoDISA STIG Cisco NX-OS Switch RTR v3r1
CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.CiscoDISA STIG Cisco IOS Switch RTR v3r1
CISC-RT-000120 - The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.CiscoDISA STIG Cisco IOS XE Switch RTR v3r1
JUEX-L2-000040 - The Juniper EX switch must be configured to manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.JuniperDISA Juniper EX Series Layer 2 Switch v2r1
JUEX-RT-000170 - The Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000340 - The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000380 - The Juniper router must be configured to restrict traffic destined to itself.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000390 - The Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000440 - The Juniper PE router must be configured to block any traffic that is destined to IP core infrastructure.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000450 - The Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode, or a firewall filter, enabled on all CE-facing interfaces.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000500 - The Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000510 - The Juniper perimeter router must be configured to block all packets with any IP options.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000520 - The Juniper PE router must be configured to ignore or block all packets with any IP options.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000590 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000610 - The Juniper router must be configured to have IP directed broadcast disabled on all interfaces.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000680 - The Juniper multicast RP router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of PIM and MSDP source-active entries.JuniperDISA Juniper EX Series Router v2r1
JUEX-RT-000720 - The Juniper BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).JuniperDISA Juniper EX Series Router v2r1
JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - filterJuniperDISA STIG Juniper Router RTR v3r1
JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - policerJuniperDISA STIG Juniper Router RTR v3r1
JUSX-AG-000120 - The Juniper SRX Services Gateway Firewall providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by implementing statistics-based screens - DoS attacks by implementing statistics-based screens.JuniperDISA Juniper SRX Services Gateway ALG v3r1
JUSX-AG-000121 - The Juniper SRX Services Gateway Firewall must implement load balancing on the perimeter firewall, at a minimum, to limit the effects of known and unknown types of denial-of-service (DoS) attacks on the network - DoS attacks on the network.JuniperDISA Juniper SRX Services Gateway ALG v3r1
JUSX-AG-000122 - The Juniper SRX Services Gateway Firewall must protect against known types of denial-of-service (DoS) attacks by implementing signature-based screens - DoS attacks by implementing signature-based screens.JuniperDISA Juniper SRX Services Gateway ALG v3r1
JUSX-AG-000124 - The Juniper SRX Services Gateway Firewall must block outbound traffic containing known and unknown denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints - DoS attacks against other networks or endpoints.JuniperDISA Juniper SRX Services Gateway ALG v3r1
JUSX-IP-000005 - The Juniper Networks SRX Series Gateway IDPS must block outbound traffic containing known and unknown DoS attacks by ensuring that rules are applied to outbound communications traffic.JuniperDISA Juniper SRX Services Gateway IDPS v2r1
JUSX-IP-000006 - The Juniper Networks SRX Series Gateway IDPS must block outbound traffic containing known and unknown DoS attacks by ensuring that signature-based objects are applied to outbound communications traffic.JuniperDISA Juniper SRX Services Gateway IDPS v2r1
JUSX-IP-000017 - The Juniper Networks SRX Series Gateway IDPS must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.JuniperDISA Juniper SRX Services Gateway IDPS v2r1
JUSX-IP-000018 - The Juniper Networks SRX Series Gateway IDPS must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing anomaly-based detection.JuniperDISA Juniper SRX Services Gateway IDPS v2r1
JUSX-IP-000019 - The Juniper Networks SRX Series Gateway IDPS must protect against or limit the effects of known types of Denial of Service (DoS) attacks by employing signatures.JuniperDISA Juniper SRX Services Gateway IDPS v2r1
JUSX-VN-000001 - The Juniper SRX Services Gateway VPN must limit the number of concurrent sessions for user accounts to one (1) and administrative accounts to three (3), or set to an organization-defined number.JuniperDISA Juniper SRX Services Gateway VPN v3r1
JUSX-VN-000016 - The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.JuniperDISA Juniper SRX Services Gateway VPN v3r1
PANW-AG-000047 - The Palo Alto Networks security platform must protect against the use of internal systems for launching denial-of-service (DoS) attacks against external networks or endpoints - DoS attacks against other networks or endpoints.Palo_AltoDISA STIG Palo Alto ALG v3r1
PANW-AG-000049 - The Palo Alto Networks security platform must block phone home traffic.Palo_AltoDISA STIG Palo Alto ALG v3r1
PANW-AG-000102 - The Palo Alto Networks security platform must protect against denial-of-service (DoS) attacks from external sources - traffic thresholds.Palo_AltoDISA STIG Palo Alto ALG v3r1
PANW-IP-000018 - The Palo Alto Networks security platform must have a denial-of-service (DoS) Protection Profile for outbound traffic applied to a policy for traffic originating from the internal zone going to the external zone.Palo_AltoDISA STIG Palo Alto IDPS v3r1
PANW-IP-000041 - The Palo Alto Networks security platform must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds) - DoS Protection ObjectPalo_AltoDISA STIG Palo Alto IDPS v3r1
PANW-IP-000041 - The Palo Alto Networks security platform must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds) - DoS Protection PolicyPalo_AltoDISA STIG Palo Alto IDPS v3r1
PANW-IP-000043 - The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.Palo_AltoDISA STIG Palo Alto IDPS v3r1