800-53|CM-8(3)

Title

AUTOMATED UNAUTHORIZED COMPONENT DETECTION

Description

The organization:

Supplemental

This control enhancement is applied in addition to the monitoring for unauthorized remote connections and mobile devices. Monitoring for unauthorized system components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms can be implemented within information systems or in other separate devices. Isolation can be achieved, for example, by placing unauthorized information system components in separate domains or subnets or otherwise quarantining such components. This type of component isolation is commonly referred to as sandboxing.

Reference Item Details

Related: AC-17,AC-18,AC-19,CA-7,RA-5,SI-3,SI-4,SI-7

Category: CONFIGURATION MANAGEMENT

Parent Title: INFORMATION SYSTEM COMPONENT INVENTORY

Family: CONFIGURATION MANAGEMENT

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1 Ensure the appropriate MongoDB software version/patches are installedMongoDBCIS MongoDB 6 L1 DB v1.1.0
1.1 Ensure the appropriate MongoDB software version/patches are installedMongoDBCIS MongoDB 5 L1 DB v1.2.0
1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - lsmodUnixCIS Debian 8 Server L1 v2.0.2
1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - lsmodUnixCIS Debian 8 Workstation L1 v2.0.2
1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - modprobeUnixCIS Debian 8 Server L1 v2.0.2
1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - modprobeUnixCIS Debian 8 Workstation L1 v2.0.2
1.1.5 Ensure noexec option set on /tmp partitionUnixCIS Google Container-Optimized OS L1 Server v1.1.0
1.1.7 Ensure noexec option set on /var partitionUnixCIS Google Container-Optimized OS L2 Server v1.1.0
1.1.9 Ensure noexec option set on /var/tmp partitionUnixCIS Debian 8 Server L1 v2.0.2
1.1.9 Ensure noexec option set on /var/tmp partitionUnixCIS Debian 8 Workstation L1 v2.0.2
1.1.12 Ensure noexec option set on /dev/shm partitionUnixCIS Google Container-Optimized OS L1 Server v1.1.0
1.1.16 Ensure noexec option set on /dev/shm partitionUnixCIS Debian 8 Workstation L1 v2.0.2
1.1.16 Ensure noexec option set on /dev/shm partitionUnixCIS Debian 8 Server L1 v2.0.2
1.1.19 Ensure noexec option set on removable media partitionsUnixCIS Debian 8 Server L1 v2.0.2
1.1.19 Ensure noexec option set on removable media partitionsUnixCIS Debian 8 Workstation L1 v2.0.2
1.3 Ensure Apache Is Installed From the Appropriate BinariesUnixCIS Apache HTTP Server 2.4 L1 v2.1.0
1.3 Ensure Apache Is Installed From the Appropriate BinariesUnixCIS Apache HTTP Server 2.4 L1 v2.1.0 Middleware
1.11 Ensure 'User consent for applications' is set to 'Do not allow user consent'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L1
1.12 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L2
1.13 Ensure that 'Users can add gallery apps to My Apps' is set to 'No'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L1
1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L1
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + NG
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL + NG
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL + NG
18.10.15.4 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + NG
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 11 Enterprise v2.0.0 L1
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + BL + NG
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 11 Enterprise v2.0.0 L1 + BL
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + NG
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + BL
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled'WindowsCIS Microsoft Windows 10 EMS Gateway v2.0.0 L1
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + BL
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + BL + NG
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 11 Stand-alone v2.0.0 L1
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 11 Stand-alone v2.0.0 L1 + BL
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1
18.10.15.8 Ensure 'Toggle user control over Insider builds' is set to 'Disabled' - DisabledWindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + NG
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + NG
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL + NG
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL + NG
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + NG
18.10.94.3.1 Ensure 'Manage preview builds' is set to 'Enabled: Disable preview builds'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1