Detections
Analytics

CCI|CCI-001941

Title

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.59 APPL-14-001150UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT I
1.124 APPL-14-003020UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT II
1.125 APPL-14-003030UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT II
1.126 APPL-14-003050UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT II
1.127 APPL-14-003051UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT II
1.128 APPL-14-003052UnixCIS Apple macOS 14 (Sonoma) STIG v1.0.0 CAT II
1.339 RHEL-09-611160UnixCIS Red Hat Enterprise Linux 9 STIG v1.0.0 CAT II
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.UnixDISA STIG AIX 7.x v3r1
ALMA-09-034340 - AlmaLinux OS 9 must use the CAC smart card driver.UnixDISA CloudLinux AlmaLinux OS 9 STIG v1r3
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
APPL-14-001150 - The macOS system must disable password authentication for SSH.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003020 - The macOS system must enforce smart card authentication.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003030 - The macOS system must allow smart card authentication.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003050 - The macOS system must enforce multifactor authentication for logon.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003051 - The macOS system must enforce multifactor authentication for the su command.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003052 - The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-15-001150 - The macOS system must disable password authentication for SSH.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
APPL-15-003020 - The macOS system must enforce smart card authentication.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
APPL-15-003030 - The macOS system must allow smart card authentication.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
APPL-15-003050 - The macOS system must enforce multifactor authentication for login.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
APPL-15-003051 - The macOS system must enforce multifactor authentication for the su command.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
APPL-15-003052 - The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.UnixDISA Apple macOS 15 (Sequoia) STIG v1r4
ARST-ND-000690 - The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.AristaDISA STIG Arista MLS EOS 4.2x NDM v2r1
ARST-ND-000690 - The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.AristaDISA STIG Arista MLS EOS 4.x NDM v2r2
AZLX-23-001180 - Amazon Linux 2023 must have SSH installed.UnixDISA Amazon Linux 2023 STIG v1r1
AZLX-23-001185 - Amazon Linux 2023 must implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.UnixDISA Amazon Linux 2023 STIG v1r1
CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA STIG Cisco ASA NDM v2r2
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA Cisco IOS XR Router NDM STIG v3r4
CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA Cisco NX OS Switch NDM STIG v3r4
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA Cisco IOS Router NDM STIG v3r5
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA Cisco IOS XE Router NDM STIG v3r5
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA Cisco IOS XE Switch NDM STIG v3r4
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA Cisco IOS Switch NDM STIG v3r5
DKER-EE-001070 - FIPS mode must be enabled on all Docker Engine - Enterprise nodes - docker info .SecurityOptionsUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r2
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v2r3
ESXI-06-200037 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200038 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using the vSphere Authentication Proxy.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200039 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-70-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 7.0 ESXi v1r4
ESXI-80-000049 - The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.VMwareDISA VMware vSphere 8.0 ESXi STIG v2r3 VMware
ESXI-80-000049 - The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.VMwareDISA VMware vSphere 8.0 ESXi STIG v2r3 VMware
FGFW-ND-000205 - The FortiGate device must implement replay-resistant authentication mechanisms for network access to privileged accountsFortiGateDISA Fortigate Firewall NDM STIG v1r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 X86 v2r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 SPARC v2r4