800-53|SC-5(1)

Title

RESTRICT INTERNAL USERS

Description

The information system restricts the ability of individuals to launch [Assignment: organization-defined denial of service attacks] against other information systems.

Supplemental

Restricting the ability of individuals to launch denial of service attacks requires that the mechanisms used for such attacks are unavailable. Individuals of concern can include, for example, hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyber attacks on third parties. Organizations can restrict the ability of individuals to connect and transmit arbitrary information on the transport medium (i.e., network, wireless spectrum). Organizations can also limit the ability of individuals to use excessive information system resources. Protection against individuals having the ability to launch denial of service attacks may be implemented on specific information systems or on boundary devices prohibiting egress to potential target systems.

Reference Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Parent Title: DENIAL OF SERVICE PROTECTION

Family: SYSTEM AND COMMUNICATIONS PROTECTION

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1 Set 'Maximum send size - connector level' to '10240'WindowsCIS Microsoft Exchange Server 2016 Edge v1.0.0
1.1 Set 'Maximum send size - connector level' to '10240'WindowsCIS Microsoft Exchange Server 2013 Edge v1.1.0
1.17 Set 'Maximum send size - organization level' to '10240'WindowsCIS Microsoft Exchange Server 2016 Hub v1.0.0
1.17 Set 'Maximum send size - organization level' to '10240'WindowsCIS Microsoft Exchange Server 2013 Hub v1.1.0
AMLS-L3-000230 - The Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.AristaDISA STIG Arista MLS DCS-7000 Series RTR v1r3
AS24-U1-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-U2-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Site v2r2 Middleware
AS24-U2-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Site v2r2
AS24-W1-000590 - The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.WindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W2-000830 - The Apache web server must be tuned to handle the operational requirements of the hosted application.WindowsDISA STIG Apache Server 2.4 Windows Site v2r1
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - allow-recursionUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - options allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - recursionUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - zone allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001080 - A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients - allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001080 - A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients - allow-recursionUnixDISA BIND 9.x STIG v2r2
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS-XR Router RTR v2r1
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS Router RTR v2r1
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS XE Router RTR v2r4
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS Switch RTR v2r1
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco NX-OS Switch RTR v2r1
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS XE Switch RTR v2r1
CISC-RT-000720 - The Cisco PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS-XR Router RTR v2r1
CISC-RT-000720 - The Cisco PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS XE Router RTR v2r4
CISC-RT-000720 - The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco NX-OS Switch RTR v2r1
CISC-RT-000720 - The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS XE Switch RTR v2r1
DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.UnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - repositoryAccessUnixDISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - team member accessUnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
EX13-MB-000155 - Exchange Mail quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000160 - Exchange Mail Quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000165 - The Exchange Mail Store storage quota must issue a warning.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000170 - Exchange Mailbox Stores must mount at startup.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX16-MB-000310 - Exchange Mail quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r4
EX16-MB-000320 - Exchange Mail Quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r4
EX16-MB-000340 - Exchange Mailbox Stores must mount at startup.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r4
FNFG-FW-000070 - The FortiGate firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.FortiGateDISA Fortigate Firewall STIG v1r1
IIST-SI-000225 - The IIS 10.0 website must be configured to limit the maxURL.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000226 - The IIS 10.0 website must be configured to limit the size of web requests.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000227 - The IIS 10.0 websites Maximum Query String limit must be configured.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000229 - Double encoded URL requests must be prohibited by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r5
IISW-SI-000225 - The IIS 8.5 website must be configured to limit the maxURL.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000226 - The IIS 8.5 website must be configured to limit the size of web requests.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000227 - The IIS 8.5 websites Maximum Query String limit must be configured.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000229 - Double encoded URL requests must be prohibited by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r5