Detections
Analytics

CSCv7|14.7

Title

Enforce Access Control to Data through Automated Tools

Description

Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system.

Reference Item Details

Category: Controlled Access Based on the Need to Know

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.10 Using Local RBAC to Limit User Access to ShellArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
1.2.2 SSH Allow ListArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 L1
1.2.2 SSH Allow ListArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
1.2.15 Ensure that the admission control plugin PodSecurityPolicy is setUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.2.23 Ensure that the --service-account-lookup argument is set to trueOpenShiftCIS Red Hat OpenShift Container Platform v1.9.0 L1
1.4.1.1 Non Default Community Names, Access Rights & ACLArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
1.4.1.1 Non Default Community Names, Access Rights & ACLArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 L1
1.17 UBTU-24-100510UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT II
1.87 UBTU-22-431015UnixCIS Ubuntu Linux 22.04 LTS STIG v1.0.0 CAT II
2.1 Ensure that authentication is enabled for Cassandra databasesUnixCIS Apache Cassandra 3.11 L2 Unix Audit v1.0.0
2.1 Ensure that authentication is enabled for Cassandra databasesUnixCIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0
2.1.3 Disable Unused Physical InterfacesArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 L1
2.1.3 Disable Unused Physical InterfacesArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
2.2 Ensure that authorization is enabled for Cassandra databasesUnixCIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0
2.2 Ensure that authorization is enabled for Cassandra databasesUnixCIS Apache Cassandra 3.11 L2 Unix Audit v1.0.0
3.2.1 (L1) Ensure DLP policies are enabledmicrosoft_azureCIS Microsoft 365 Foundations v6.0.1 L1 E3
3.2.1 (L1) Ensure DLP policies are enabledmicrosoft_azureCIS Microsoft 365 Foundations v6.0.1 L1 E5
3.2.2 (L1) Ensure DLP policies are enabled for Microsoft Teamsmicrosoft_azureCIS Microsoft 365 Foundations v6.0.1 L1 E5
3.3 Restrict Query OriginsUnixCIS BIND DNS v1.0.0 L1 Authoritative Name Server
3.3 Restrict Query OriginsUnixCIS BIND DNS v1.0.0 L1 Caching Only Name Server
3.3.1.1 PIM Accept-RegisterArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
3.3.1.2 PIM Accept-RPArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
3.3.1.3 PIM SSMArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
3.3.3 IGMP Snooping ACLArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
3.3.4 MLD Snooping ACLArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
3.7 RA GuardArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
4.1.5 Ensure that Service Account Tokens are only mounted where necessaryGCPCIS Google Kubernetes Engine GKE Autopilot v1.3.0 L1
4.1.5 Ensure that Service Account Tokens are only mounted where necessaryGCPCIS Google Kubernetes Engine GKE v1.9.0 L1 GCP
4.2.7 Ensure that the --make-iptables-util-chains argument is set to trueOpenShiftCIS Red Hat OpenShift Container Platform v1.9.0 L1
4.3.1 Control Plane ACL ManagementArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 L2
4.3.1 Control Plane ACL ManagementArubaOSCIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations
4.8 Make use of default rolesPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
6.2.2 (L1) Host must ensure all datastores have unique namesVMwareCIS VMware ESXi 8.0 v1.3.0 L1 VMware
6.2.10 Ensure 'JAVA_ADMIN' Is Revoked From Unauthorized 'GRANTEE'OracleDBCIS Oracle Database 26ai v1.0.0 L1 RDBMS
6.2.10 Ensure 'JAVA_ADMIN' Is Revoked From Unauthorized 'GRANTEE'OracleDBCIS Oracle Database 19c v2.0.0 L1 RDBMS
6.2.10 Ensure 'JAVA_ADMIN' Is Revoked From Unauthorized 'GRANTEE'OracleDBCIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS OracleDB
6.2.10 Ensure 'JAVA_ADMIN' Is Revoked From Unauthorized 'GRANTEE'OracleDBCIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS OracleDB
6.2.10 Ensure 'JAVA_ADMIN' Is Revoked From Unauthorized 'GRANTEE'OracleDBCIS Oracle Database 23ai v1.1.0 L1 RDBMS
7.6 (L1) Virtual machines must limit console sharing.VMwareCIS VMware ESXi 8.0 v1.3.0 L1 VMware
8.1 Ensure ServerTokens is Set to 'Prod' or 'ProductOnly'UnixCIS Apache HTTP Server 2.2 L1 v3.6.0 Middleware
8.1 Ensure ServerTokens is Set to 'Prod' or 'ProductOnly'UnixCIS Apache HTTP Server 2.2 L2 v3.6.0
8.1 Ensure ServerTokens is Set to 'Prod' or 'ProductOnly'UnixCIS Apache HTTP Server 2.2 L1 v3.6.0
8.1 Ensure ServerTokens is Set to 'Prod' or 'ProductOnly'UnixCIS Apache HTTP Server 2.4 v2.3.0 L1
10.1 Ensure SELinux Is Enabled in Enforcing Mode - config fileUnixCIS BIND DNS v1.0.0 L2 Caching Only Name Server
10.1 Ensure SELinux Is Enabled in Enforcing Mode - config fileUnixCIS BIND DNS v1.0.0 L2 Authoritative Name Server
10.1 Ensure SELinux Is Enabled in Enforcing Mode - current modeUnixCIS BIND DNS v1.0.0 L2 Caching Only Name Server
10.1 Ensure SELinux Is Enabled in Enforcing Mode - current modeUnixCIS BIND DNS v1.0.0 L2 Authoritative Name Server
11.1 Ensure SELinux Is Enabled in Enforcing ModeUnixCIS Apache HTTP Server 2.4 v2.3.0 L2
11.1 Ensure SELinux Is Enabled in Enforcing ModeUnixCIS Apache HTTP Server 2.2 L2 v3.6.0 Middleware
11.1 Ensure SELinux Is Enabled in Enforcing ModeUnixCIS Apache HTTP Server 2.2 L2 v3.6.0