GEN008600 - The system must be configured to only boot from the system boot device.

Information

The ability to boot from removable media is the same as being able to boot into single user, or maintenance, mode without a password. This ability could allow a malicious user to boot the system and perform changes with the potential to compromise or damage the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure the system to only boot from system startup media.

Procedure:
On systems with a BIOS or system controller use the BIOS interface at startup to remove all but the proper boot device from the boot device list.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|I, CCI|CCI-000366, Rule-ID|SV-218719r603259_rule, STIG-ID|GEN008600, STIG-Legacy|SV-63139, STIG-Legacy|V-1013, Vuln-ID|V-218719

Plugin: Unix

Control ID: a04df859e97fc8f12aa5e2c58e8951315ae71d3bf66d2335492d8e6766eca414