CCI|CCI-001094

Title

The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.

Reference Item Details

Category: 2009

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AMLS-L3-000230 - The Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.AristaDISA STIG Arista MLS DCS-7000 Series RTR v1r3
ARST-RT-000450 - The Arista perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).AristaDISA STIG Arista MLS EOS 4.2x Router v1r1
AS24-U1-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Server v2r6 Middleware
AS24-U1-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Server v2r6
AS24-U2-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Site v2r4 Middleware
AS24-U2-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.UnixDISA STIG Apache Server 2.4 Unix Site v2r4
AS24-W1-000590 - The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.WindowsDISA STIG Apache Server 2.4 Windows Server v2r3
AS24-W2-000830 - The Apache web server must be tuned to handle the operational requirements of the hosted application.WindowsDISA STIG Apache Server 2.4 Windows Site v2r1
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - allow-recursionUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - options allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - recursionUnixDISA BIND 9.x STIG v2r2
BIND-9X-001055 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers - zone allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001080 - A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients - allow-queryUnixDISA BIND 9.x STIG v2r2
BIND-9X-001080 - A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients - allow-recursionUnixDISA BIND 9.x STIG v2r2
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS Router RTR v2r6
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS-XR Router RTR v2r4
CISC-RT-000310 - The Cisco perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS XE Router RTR v2r9
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS XE Switch RTR v2r5
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco IOS Switch RTR v2r5
CISC-RT-000310 - The Cisco perimeter switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CiscoDISA STIG Cisco NX-OS Switch RTR v2r3
CISC-RT-000720 - The Cisco PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS XE Router RTR v2r9
CISC-RT-000720 - The Cisco PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS-XR Router RTR v2r4
CISC-RT-000720 - The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco IOS XE Switch RTR v2r5
CISC-RT-000720 - The Cisco PE switch must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.CiscoDISA STIG Cisco NX-OS Switch RTR v2r3
DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.UnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - repositoryAccessUnixDISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - team member accessUnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
EX13-MB-000155 - Exchange Mail quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000160 - Exchange Mail Quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000165 - The Exchange Mail Store storage quota must issue a warning.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX13-MB-000170 - Exchange Mailbox Stores must mount at startup.WindowsDISA Microsoft Exchange 2013 Mailbox Server STIG v2r2
EX16-MB-000310 - Exchange Mail quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r6
EX16-MB-000320 - Exchange Mail Quota settings must not restrict receiving mail.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r6
EX16-MB-000340 - Exchange Mailbox Stores must mount at startup.WindowsDISA Microsoft Exchange 2016 Mailbox Server STIG v2r6
FNFG-FW-000070 - The FortiGate firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.FortiGateDISA Fortigate Firewall STIG v1r3
IIST-SI-000225 - The IIS 10.0 website must be configured to limit the maxURL.WindowsDISA IIS 10.0 Site v2r9
IIST-SI-000226 - The IIS 10.0 website must be configured to limit the size of web requests.WindowsDISA IIS 10.0 Site v2r9
IIST-SI-000227 - The IIS 10.0 websites Maximum Query String limit must be configured.WindowsDISA IIS 10.0 Site v2r9
IIST-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r9
IIST-SI-000229 - Double encoded URL requests must be prohibited by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r9
IIST-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.WindowsDISA IIS 10.0 Site v2r9
IISW-SI-000225 - The IIS 8.5 website must be configured to limit the maxURL.WindowsDISA IIS 8.5 Site v2r9
IISW-SI-000226 - The IIS 8.5 website must be configured to limit the size of web requests.WindowsDISA IIS 8.5 Site v2r9
IISW-SI-000227 - The IIS 8.5 websites Maximum Query String limit must be configured.WindowsDISA IIS 8.5 Site v2r9
IISW-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r9
IISW-SI-000229 - Double encoded URL requests must be prohibited by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r9
IISW-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.WindowsDISA IIS 8.5 Site v2r9
JUEX-RT-000310 - The Juniper PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.JuniperDISA Juniper EX Series Router v1r3
JUEX-RT-000500 - The Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).JuniperDISA Juniper EX Series Router v1r3
JUNI-RT-000310 - The Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).JuniperDISA STIG Juniper Router RTR v2r4