800-53|AC-17(1)

Title

AUTOMATED MONITORING / CONTROL

Description

The information system monitors and controls remote access methods.

Supplemental

Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

Reference Item Details

Related: AU-12,AU-2

Category: ACCESS CONTROL

Parent Title: REMOTE ACCESS

Family: ACCESS CONTROL

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.6.1 Ensure 'SSH source restriction' is set to an authorized IP addressCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
1.6.2 Ensure 'SSH version 2' is enabledCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
2.2.32 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2016 STIG v2.0.0 STIG MS
2.2.34 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2022 STIG v1.0.0 STIG MS
2.2.35 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account, Enterprise Admins Group, and Domain Admins Group' (STIG MS only)WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 STIG MS
2.7 Ensure TLS authentication for Docker daemon is configured - tlscacertUnixCIS Docker v1.6.0 L1 Docker Linux
2.7 Ensure TLS authentication for Docker daemon is configured - tlscertUnixCIS Docker v1.6.0 L1 Docker Linux
2.7 Ensure TLS authentication for Docker daemon is configured - tlskeyUnixCIS Docker v1.6.0 L1 Docker Linux
2.7 Ensure TLS authentication for Docker daemon is configured - tlsverifyUnixCIS Docker v1.6.0 L1 Docker Linux
2.8.1 Ensure 'Allow remote access connections to this machine' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.2 Ensure 'Allow remote users to interact with elevated windows in remote assistance sessions' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.3 Ensure 'Configure the required domain names for remote access clients' is set to 'Enabled' with a domain definedWindowsCIS Google Chrome L1 v3.0.0
2.8.4 Ensure 'Enable curtaining of remote access hosts' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.5 Ensure 'Enable firewall traversal from remote access host' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.6 Ensure 'Enable or disable PIN-less authentication for remote access hosts' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
2.8.7 Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'.WindowsCIS Google Chrome L1 v3.0.0
2.32 Ensure 'Allow remote debugging' is set to 'Disabled'WindowsCIS Google Chrome L1 v3.0.0
3.2 Ensure 'Allow unmanaged devices' is set to 'False'WindowsCIS Microsoft Exchange Server 2019 L1 MDM v1.0.0
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.16 Ensure 'Allow adding VPN configurations' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.29 Ensure 'Allow proximity based password sharing requests' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMMobileIron - CIS Apple iOS 17 Institution Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMAirWatch - CIS Apple iPadOS 17 Institutionally Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMAirWatch - CIS Apple iOS 17 Institution Owned L1
3.2.1.30 Ensure 'Allow password sharing (supervised only)' is set to 'Disabled'MDMMobileIron - CIS Apple iPadOS 17 Institutionally Owned L1
3.5.1.1 Ensure Uncomplicated Firewall is installedUnixCIS Ubuntu Linux 20.04 LTS Workstation L1 v1.0.0
3.5.1.1 Ensure Uncomplicated Firewall is installedUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.0.0
3.5.2.1 Ensure nftables is installedUnixCIS Ubuntu Linux 20.04 LTS Workstation L1 v1.0.0
3.5.2.1 Ensure nftables is installedUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.0.0
3.5.3.2.3 Ensure iptables rules exist for all open ports - PPSM CLSA and vulnerability assessments.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Accessmicrosoft_azureCIS Microsoft Azure Foundations v2.1.0 L2
3.9 Ensure 'Require encryption on device' is set to 'True'WindowsCIS Microsoft Exchange Server 2019 L1 MDM v1.0.0
4.10 (L1) Host must verify certificates for TLS remote logging endpointsVMwareCIS VMware ESXi 8.0 v1.1.0 L1
4.11 (L1) Host must use strict x509 verification for TLS-enabled remote logging endpointsVMwareCIS VMware ESXi 8.0 v1.1.0 L1
5.1.1 Enable Compromised Host QuarantineFortiGateCIS Fortigate 7.0.x v1.3.0 L1
5.117 - Users must be prevented from connecting using Terminal Services.WindowsDISA Windows Vista STIG v6r41
AIOS-12-011200 - Apple iOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS 12 v2r1
AIOS-12-011200 - Apple iOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS 12 v2r1
AIOS-13-011200 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 13 v2r1
AIOS-13-011200 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 13 v2r1
AIOS-14-009400 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMMobileIron - DISA Apple iOS/iPadOS 14 v1r3
AIOS-14-009400 - Apple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.MDMAirWatch - DISA Apple iOS/iPadOS 14 v1r3
AIX7-00-001137 - AIX must be able to control the ability of remote login for users.UnixDISA STIG AIX 7.x v2r9
AIX7-00-002100 - AIX must monitor and record successful remote logins.UnixDISA STIG AIX 7.x v2r1
AIX7-00-002100 - AIX must monitor and record successful remote logins.UnixDISA STIG AIX 7.x v2r9