CCI|CCI-002235

Title

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Reference Item Details

Category: 2013

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.6.1.9 Ensure non-privileged users are prevented from executing privileged functionsUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
2.023 - Standard user accounts must only have Read permissions to the Winlogon registry key.WindowsDISA Windows Vista STIG v6r41
3.030 - Anonymous access to the registry must be restricted.WindowsDISA Windows Vista STIG v6r41
4.005 - Unapproved Users have access to Debug programs.WindowsDISA Windows Vista STIG v6r41
4.009 - Unauthorized users are granted right to Act as part of the operating system.WindowsDISA Windows Vista STIG v6r41
4.027 - Only administrators responsible for the system must have Administrator rights on the system.WindowsDISA Windows Vista STIG v6r41
6.1.15 Ensure the file permissions ownership and group membership of system files and commands match the vendor valuesUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
APPL-13-002069 - The macOS system must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.UnixDISA STIG Apple macOS 13 v1r3
AS24-U1-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.UnixDISA STIG Apache Server 2.4 Unix Server v2r6 Middleware
AS24-U1-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.UnixDISA STIG Apache Server 2.4 Unix Server v2r6
AS24-W1-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.WindowsDISA STIG Apache Server 2.4 Windows Server v2r3
AS24-W2-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.WindowsDISA STIG Apache Server 2.4 Windows Site v2r1
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - 800-171
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - 800-53r5 Moderate
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - 800-53r5 High
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - 800-53r4 Moderate
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - 800-171
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - 800-53r4 High
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - CNSSI 1253
Catalina - Configure the System to Block Non-Privileged Users from Executing Privileged FunctionsUnixNIST macOS Catalina v1.5.0 - All Profiles
DB2X-00-007000 - DB2 must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasuresIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.UnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - repositoryAccessUnixDISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r1
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - team member accessUnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - groupUnixMcAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6
DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - groupUnixMcAfee Virus Scan Enterprise for Linux 1.9x/2.0x Managed Client v1r5
DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - userUnixMcAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6
DTAVSEL-202 - The nails user and nailsgroup group must be restricted to the least privilege access required for the intended role - userUnixMcAfee Virus Scan Enterprise for Linux 1.9x/2.0x Managed Client v1r5
DTOO201 - Connection verification of permissions must be enforced.WindowsDISA STIG Microsoft Office System 2013 v2r1
DTOO201 - Connection verification of permissions must be enforced.WindowsDISA STIG Microsoft Office System 2016 v2r2
DTOO201 - Office System - Connection verification of permissions must be enforced.WindowsDISA STIG Office System 2010 v1r12
EP11-00-007400 - The EDB Postgres Advanced Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.PostgreSQLDBEDB PostgreSQL Advanced Server v11 DB Audit v2r2
GOOG-12-012200 - Google Android 12 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].MDMMobileIron - DISA Google Android 12 COBO v1r1
GOOG-12-012200 - Google Android 12 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].MDMAirWatch - DISA Google Android 12 COBO v1r1
GOOG-12-012200 - Google Android 12 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].MDMMobileIron - DISA Google Android 12 COPE v1r1
GOOG-12-012200 - Google Android 12 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].MDMAirWatch - DISA Google Android 12 COPE v1r1
GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].MDMAirWatch - DISA Google Android 13 COBO v1r1
GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].MDMMobileIron - DISA Google Android 13 COPE v1r1
GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].MDMAirWatch - DISA Google Android 13 COPE v1r1
GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].MDMMobileIron - DISA Google Android 13 COBO v1r1
IIST-SV-000144 - IIS 10.0 web server system files must conform to minimum file permission requirements.WindowsDISA IIS 10.0 Server v2r10
IISW-SV-000144 - IIS 8.5 web server system files must conform to minimum file permission requirements.WindowsDISA IIS 8.5 Server v2r7
JBOS-AS-000475 - The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.UnixDISA RedHat JBoss EAP 6.3 STIG v2r3
JUEX-NM-000930 - The Juniper EX switch must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.JuniperDISA Juniper EX Series Network Device Management v1r4