Theme

CAT|II

Title

DISA Severity Level 2

Description

Any vulnerability, the exploitation of which has a potential to result in loss of Confidentiality, Availability, or Integrity.

Reference Item Details

Reference: CAT - DISA Severity Level

Category: Severity Level

Audit Items

View all Reference Audit Items

Name	Plugin	Audit Name
1.001 - Physical security of the Automated Information System (AIS) does not meet DISA requirements.	Windows	DISA Windows Vista STIG v6r41
1.007 - Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.	Windows	DISA Windows Vista STIG v6r41
1.7 Declare an EJB authorization policy for deployed applications	Unix	Redhat JBoss EAP 5.x
1.008 - Shared user accounts are permitted on the system.	Windows	DISA Windows Vista STIG v6r41
1.15 - Ensure IBM JRE 1.6 is configured correctly - 'policy.provider = sun.security.provider.PolicyFile'	Unix	Redhat JBoss EAP 5.x
1.17 The allRolesMode must be configured to 'strict' - 'allRolesMode = strict'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'JBossWS password != empty'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'JBossWS principal != sa'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'JBossWS userName != sa'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'jbossws-users.properties - kermit'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'jmx-console password != empty'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'jmx-console principal != sa'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'jmx-console userName != sa'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'jmx-console-users.properties - admin'	Unix	Redhat JBoss EAP 5.x
1.19 - Remove, rename, or comment out the default user accounts from production servers - 'messaging-users.properties - guest'	Unix	Redhat JBoss EAP 5.x
1.20 - Remove default roles from production servers - 'admin-console default role != JBossAdmin\|HttpInvoker\|friend\|guest'	Unix	Redhat JBoss EAP 5.x
1.20 - Remove default roles from production servers - 'console-mgr default role != JBossAdmin\|HttpInvoker\|friend\|guest'	Unix	Redhat JBoss EAP 5.x
1.20 - Remove default roles from production servers - 'jmx-console default role != JBossAdmin\|HttpInvoker\|friend\|guest'	Unix	Redhat JBoss EAP 5.x
1.22 DefaultCacheTimeout must be configured properly for active security domains - 'DefaultCacheTimeout <= 1800'	Unix	Redhat JBoss EAP 5.x
2.001 - Permissions for event logs must conform to minimum requirements - application.evtx	Windows	DISA Windows Vista STIG v6r41
2.001 - Permissions for event logs must conform to minimum requirements - security.evtx	Windows	DISA Windows Vista STIG v6r41
2.001 - Permissions for event logs must conform to minimum requirements - system.evtx	Windows	DISA Windows Vista STIG v6r41
2.1 Configure Java Security Manager to use an environment specific policy - 'JAVA_OPTS -Djava.security.manager -Djava.security.policy'	Unix	Redhat JBoss EAP 5.x
2.006 - ACLs for system files and directories do not conform to minimum requirements. - 'C:'	Windows	DISA Windows Vista STIG v6r41
2.006 - ACLS FOR SYSTEM FILES AND DIRECTORIES DO NOT CONFORM TO MINIMUM REQUIREMENTS. - 'C:\Program Files'	Windows	DISA Windows Vista STIG v6r41
2.006 - ACLS FOR SYSTEM FILES AND DIRECTORIES DO NOT CONFORM TO MINIMUM REQUIREMENTS. - 'C:\Windows'	Windows	DISA Windows Vista STIG v6r41
2.014 - ACLs for disabled services do not conform to minimum standards.	Windows	DISA Windows Vista STIG v6r41
2.015 - File share ACLs have not been reconfigured to remove the Everyone group.	Windows	DISA Windows Vista STIG v6r41
2.019 - Security-related Software Patches are not applied.	Windows	DISA Windows Vista STIG v6r41
2.021 - Remove Software Certificate Installation Files	Windows	DISA Windows Vista STIG v6r41
2.23 Ensure Security Audit Appender is enabled - 'Audit Appender = true'	Unix	Redhat JBoss EAP 5.x
2.24 Ensure Security Audit Provider is enabled - 'Audit Provider = true'	Unix	Redhat JBoss EAP 5.x
2.25 Ensure Configure SecurityInterceptor logging level is set correctly - 'org.jboss.ejb.plugins.SecurityInterceptor = true'	Unix	Redhat JBoss EAP 5.x
2.26 Ensure logging is enabled for Microcontainer bootstrap operations - 'SecurityInterceptor logging level = true'	Unix	Redhat JBoss EAP 5.x
2.27 - Ensure logging is enabled for web-based requests if required by deployed applications - 'AccessLogValve = true'	Unix	Redhat JBoss EAP 5.x
2.31 - Deny the JBoss process owner console access	Unix	Redhat JBoss EAP 5.x
2.32/2.33 - Set JBoss file ownership/permissions	Unix	Redhat JBoss EAP 5.x
3.011 - The required legal notice must be configured to display before console logon.	Windows	DISA Windows Vista STIG v6r41
3.028 - The built-in Windows password complexity policy must be enabled.	Windows	DISA Windows Vista STIG v6r41
3.032 - Ctrl+Alt+Del security attention sequence is Disabled.	Windows	DISA Windows Vista STIG v6r41
3.034 - Unencrypted passwords must not be sent to third-party SMB Servers.	Windows	DISA Windows Vista STIG v6r41
3.040 - Automatic logons must be disabled.	Windows	DISA Windows Vista STIG v6r41
3.042 - Outgoing secure channel traffic is not signed when possible.	Windows	DISA Windows Vista STIG v6r41
3.043 - Outgoing secure channel traffic is not encrypted when possible.	Windows	DISA Windows Vista STIG v6r41
3.045 - The Windows SMB client is not enabled to perform SMB packet signing when possible.	Windows	DISA Windows Vista STIG v6r41
3.046 - The Windows SMB server is not enabled to perform SMB packet signing when possible.	Windows	DISA Windows Vista STIG v6r41
3.047 - The Smart Card removal option is set to take no action.	Windows	DISA Windows Vista STIG v6r41
3.052 - Ejection of removable NTFS media is not restricted to Administrators.	Windows	DISA Windows Vista STIG v6r41
3.057 - Reversible password encryption is not disabled.	Windows	DISA Windows Vista STIG v6r41
3.070 - The system is configured to permit storage of credentials or .NET Passports.	Windows	DISA Windows Vista STIG v6r41