CSCv6|8.4

Title

Enable anti-exploitation features such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), virtualization/containerization, etc.

Description

Enable anti-exploitation features such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), virtualization/containerization, etc. For increased protection, deploy capabilities such as Enhanced Mitigation Experience Toolkit (EMET) that can be configured to apply these protections to a broader set of applications and executables.

Reference Item Details

Category: Malware Defenses

Family: System

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.35 Ensure that the admission control policy is set to EventRateLimitUnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.1.36 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.36 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes 1.13 Benchmark v1.4.0 L1
1.1.36 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
1.2.2.5.1 Configure 'Do not process the legacy run list'WindowsCIS Windows 2003 DC v3.1.0
1.2.2.5.1 Configure 'Do not process the legacy run list'WindowsCIS Windows 2003 MS v3.1.0
1.2.2.5.2 Configure 'Do not process the run once list'WindowsCIS Windows 2003 DC v3.1.0
1.2.2.5.2 Configure 'Do not process the run once list'WindowsCIS Windows 2003 MS v3.1.0
1.2.3.1.7 Configure 'Turn off Event Viewer 'Events.asp' links'WindowsCIS Windows 8 L1 v1.0.0
1.2.3.2.2 Configure 'Do not process the run once list'WindowsCIS Windows 8 L1 v1.0.0
1.2.3.2.3 Configure 'Do not process the legacy run list'WindowsCIS Windows 8 L1 v1.0.0
1.2.4.2.2.25 Set 'Allow enhanced PINs for startup' to 'Enabled'WindowsCIS Windows 8 L1 v1.0.0
1.2.4.9 Set 'Turn off Data Execution Prevention for Explorer' to 'Disabled'WindowsCIS Windows 8 L1 v1.0.0
1.2.9 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes v1.20 Benchmark v1.0.0 L1 Master
1.2.10 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes Benchmark v1.5.1 L1
1.2.10 Ensure that the admission control plugin EventRateLimit is setUnixCIS Kubernetes Benchmark v1.6.1 L1 Master
1.5.1 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.5.1 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.1.0
1.5.1 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 20.04 LTS Workstation L1 v1.1.0
1.5.1 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - configUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - configUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - configUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - configUnixCIS Ubuntu Linux 20.04 LTS Workstation L1 v1.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctlUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctlUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctlUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctlUnixCIS Ubuntu Linux 20.04 LTS Workstation L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Distribution Independent Linux Workstation L1 v2.0.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Amazon Linux v2.1.0 L1
1.5.2 Ensure XD/NX support is enabledUnixCIS Oracle Linux 6 Server L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 16.04 LTS Server L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Distribution Independent Linux Server L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS CentOS 6 Server L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Red Hat 6 Server L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Distribution Independent Linux Workstation L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS CentOS 6 Workstation L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Red Hat 6 Workstation L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Ubuntu Linux 16.04 LTS Workstation L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Distribution Independent Linux Server L1 v2.0.0
1.5.2 Ensure XD/NX support is enabledUnixCIS Oracle Linux 6 Workstation L1 v1.1.0
1.5.2 Ensure XD/NX support is enabledUnixHuawei EulerOS 2 Server L1 v1.0
1.5.2 Ensure XD/NX support is enabledUnixHuawei EulerOS 2 Workstation L1 v1.0
1.5.3 Ensure address space layout randomization (ASLR) is enabledUnixCIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0
1.12.1 Do not process the legacy run listWindowsCIS Windows 2008 Enterprise v1.2.0
1.12.1 Do not process the legacy run listWindowsCIS Windows 2008 SSLF v1.2.0
1.12.2 Do not process the run once listWindowsCIS Windows 2008 SSLF v1.2.0
1.12.2 Do not process the run once listWindowsCIS Windows 2008 Enterprise v1.2.0